Known vulnerabilities in Craft CMS - page 3

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126477 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-25498
CWE-74 Low
No
No
4.16.18, 5.8.22 17.04.2026 SB2026021833
#VU123016 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-25495
CWE-89 Medium
No
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123014 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25496
CWE-79 Low
No
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123013 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25491
CWE-79 Low
No
No
5.8.22 18.02.2026 SB2026021833
#VU120915 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2025-68455
CWE-470 Low
Available
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120914 - Exposure of sensitive information to an unauthorized actor
CVE-2025-68436
CWE-200 Medium
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120913 - Server-Side Request Forgery (SSRF)
CVE-2025-68437
CWE-918 Low
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120912 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-68454
CWE-94 Low
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120911 - Improper input validation
CVE-2025-68456
CWE-20 High
Available
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU110085 - Improper input validation
CVE-2025-35939
CWE-20 Medium
No
Exploited
4.15.3, 5.7.5 03.06.2025 SB2025060309
#VU108656 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-46731
CWE-94 Low
Available
No
4.14.13, 5.6.15 05.05.2025 SB2025050549
#VU107991 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-32432
CWE-94 Critical
Available
Exploited
3.9.15, 4.14.15, 5.6.17 28.04.2025 SB2025042834
#VU102307 - Use of Hard-coded Credentials
CVE-2025-23209
CWE-798 High
Available
Exploited
4.13.8, 5.5.8 06.01.2025 SB2025010620
#VU101835 - Exposed Dangerous Method or Function
CVE-2024-56145
CWE-749 High
Available
Exploited
4.13.2, 5.5.2 18.12.2024 SB2024121837
#VU126472 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-45406
CWE-80 Low
No
No
5.1.2 09.09.2024 SB2024050924
#VU94748 - Insufficient Session Expiration
CVE-2024-41800
CWE-613 Medium
No
No
5.2.3 26.07.2024 SB2024072609
#VU89289 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.1.2 09.05.2024 SB2024050924
#VU87179 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
3.9.11, 4.8.1 07.03.2024 SB2024030712
#VU86276 - Incorrect Default Permissions
CVE-2024-24821
CWE-276 Low
No
No
4.7.2.1 08.02.2024 SB2024020870
SB2024021508
SB2024022241
and 3 more
#VU84989 - Permissions, Privileges, and Access Controls
CWE-264 High
No
No
4.5.14 04.01.2024 SB2024010423


Showing elements 41 - 60 out of 142