Known vulnerabilities in Craft CMS - page 4

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU132954 - Missing Authorization
CVE-2026-50284
CWE-862 Medium
No
No
4.17.15, 5.9.22 29.05.2026 SB2026052953
#VU132779 - Improper Access Control
CVE-2026-50280
CWE-284 Medium
No
No
5.9.21 29.05.2026 SB2026052955
#VU129392 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-28784
CWE-1336 Low
No
No
4.16.18, 5.8.22 04.05.2026 SB2026050445
#VU129391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.8.22 04.05.2026 SB2026050445
#VU126482 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-27127
CWE-367 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126481 - Server-Side Request Forgery (SSRF)
CVE-2026-27129
CWE-918 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126480 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126479 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-27126
CWE-79 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126478 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-27128
CWE-367 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126476 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2025-57811
CWE-1336 Low
No
No
4.16.6, 5.8.7 17.04.2026 SB20260417105
#VU126475 - Improper Access Control
CVE-2025-54417
CWE-284 Low
No
No
4.16.3, 5.8.4 17.04.2026 SB20260417104
#VU124289 - Missing Authorization
CVE-2026-33161
CWE-862 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124288 - Missing Authorization
CVE-2026-33162
CWE-862 Medium
No
No
5.9.14 24.03.2026 SB2026032462
#VU124287 - Missing Authorization
CWE-862 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124286 - Authorization Bypass Through User-Controlled Key
CVE-2026-33160
CWE-639 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124284 - Exposure of sensitive information to an unauthorized actor
CVE-2026-33158
CWE-200 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124283 - Missing Authentication for Critical Function
CVE-2026-33159
CWE-306 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124282 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2026-33157
CWE-470 Medium
No
No
5.9.13 24.03.2026 SB2026032461
#VU123018 - Server-Side Request Forgery (SSRF)
CVE-2026-25493
CWE-918 Medium
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123012 - Server-Side Request Forgery (SSRF)
CVE-2026-25492
CWE-918 Low
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833


Showing elements 61 - 80 out of 137