Known vulnerabilities in Craft CMS - page 3

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134672 - Missing Authorization
CVE-2026-44012
CWE-862 Low
No
No
5.9.18 16.06.2026 SB2026061670
#VU134669 - Improper input validation
CVE-2026-41130
CWE-20 Medium
No
No
4.17.9, 5.9.15 16.06.2026 SB2026061669
#VU134668 - Server-Side Request Forgery (SSRF)
CVE-2026-41129
CWE-918 Low
No
No
4.17.9, 5.9.15 16.06.2026 SB2026061669
#VU134667 - Missing Authorization
CVE-2026-41128
CWE-862 Low
No
No
5.9.15 16.06.2026 SB2026061669
#VU134666 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-32263
CWE-94 Low
No
No
5.9.11 16.06.2026 SB2026061668
#VU134665 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-32264
CWE-94 Low
No
No
4.17.5, 5.9.11 16.06.2026 SB2026061668
#VU134664 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-33051
CWE-79 Low
No
No
5.9.11 16.06.2026 SB2026061668
#VU134663 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-32262
CWE-22 Low
No
No
4.17.5, 5.9.11 16.06.2026 SB2026061668
#VU134662 - Improper Access Control
CVE-2026-32267
CWE-284 High
No
No
4.17.6, 5.9.12 16.06.2026 SB2026061667
#VU134661 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-31859
CWE-79 Medium
No
No
4.17.3, 5.9.7 16.06.2026 SB2026061666
#VU134660 - Cross-Site Request Forgery (CSRF)
CVE-2026-29113
CWE-352 Low
No
No
4.17.4, 5.9.7 16.06.2026 SB2026061666
#VU134659 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-31857
CWE-94 Medium
No
No
4.17.4, 5.9.9 16.06.2026 SB2026061666
#VU134658 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-31858
CWE-89 Low
No
No
5.9.9 16.06.2026 SB2026061666
#VU133305 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
4.17.8, 5.9.14 03.06.2026 SB2026060343
#VU133304 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Low
Available
No
5.9.14 03.06.2026 SB2026060343
#VU133303 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
4.17.7, 5.9.13 03.06.2026 SB2026060342
#VU132935 - Improper Authorization
CVE-2026-50283
CWE-285 Medium
No
No
4.17.14, 5.9.21 29.05.2026 SB2026052955
#VU132934 - Improper Authorization
CVE-2026-50282
CWE-285 Medium
No
No
4.17.14, 5.9.21 29.05.2026 SB2026052955
#VU132781 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-50281
CWE-915 Medium
No
No
5.9.21 29.05.2026 SB2026052955
#VU132778 - Improper Authorization
CVE-2026-50279
CWE-285 Medium
No
No
5.9.21 29.05.2026 SB2026052955


Showing elements 41 - 60 out of 137