Known vulnerabilities in Craft CMS - page 5

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146757 - Missing Authorization
CVE-2026-92589
CWE-862 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146747 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-92590
CWE-79 Low
No
No
5.10.13 02.09.2026 SB2026090260
#VU146746 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-79991
CWE-89 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146745 - Not Failing Securely (\'Failing Open\')
CVE-2026-92591
CWE-636 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146743 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-92592
CWE-1336 Medium
No
No
4.18.6, 5.10.13 02.09.2026 SB2026090260
#VU146742 - Exposure of sensitive information to an unauthorized actor
CVE-2026-92594
CWE-200 Medium
No
No
5.11.0 02.09.2026 SB2026090259
#VU145007 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-86732
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU145006 - Missing Authorization
CVE-2026-86731
CWE-862 Low
No
No
5.10.12 25.08.2026 SB2026081960
#VU145005 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-86730
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU144284 - Missing Authorization
CVE-2026-84802
CWE-862 Low
No
No
5.10.12 19.08.2026 SB2026081960
#VU144280 - Missing Authorization
CVE-2026-84798
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144279 - Missing Authorization
CVE-2026-84797
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144278 - Authorization Bypass Through User-Controlled Key
CVE-2026-84796
CWE-639 Medium
No
No
5.10.11 19.08.2026 SB2026081958
#VU144277 - Improper Privilege Management
CVE-2026-84795
CWE-269 High
No
No
5.10.11 19.08.2026 SB2026081958
#VU144276 - Missing Authorization
CVE-2026-84794
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-84793
CWE-79 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144274 - Missing Authorization
CVE-2026-84792
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU34922 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-9554
CWE-79 Low
Available
No
- 31.12.2019 SB2019123136
#VU35824 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12823
CWE-79 Low
No
No
- 18.06.2019 SB2019061822
#VU9828 - Unrestricted Upload of File with Dangerous Type
CVE-2018-3814
CWE-434 Medium
No
No
- 01.01.2018 SB2018010205


Showing elements 81 - 100 out of 142