Known vulnerabilities in Craft CMS - page 5

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134657 - Authorization Bypass Through User-Controlled Key
CVE-2026-29069
CWE-639 Medium
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134656 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134655 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-28697
CWE-1336 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134654 - Incomplete List of Disallowed Inputs
CVE-2026-28783
CWE-184 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134653 - Improper Access Control
CVE-2026-28696
CWE-284 Medium
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134652 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-28781
CWE-915 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134651 - Authorization Bypass Through User-Controlled Key
CVE-2026-28782
CWE-639 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU126477 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-25498
CWE-74 Low
No
No
4.16.18, 5.8.22 17.04.2026 SB2026021833
#VU123019 - Improper Privilege Management
CVE-2026-25497
CWE-269 Medium
No
No
4.17.0, 5.9.0 18.02.2026 SB2026021831
#VU123017 - Server-Side Request Forgery (SSRF)
CVE-2026-25494
CWE-918 Medium
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123016 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-25495
CWE-89 Medium
No
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123014 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25496
CWE-79 Low
No
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123013 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25491
CWE-79 Low
No
No
5.8.22 18.02.2026 SB2026021833
#VU120915 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2025-68455
CWE-470 Low
Available
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120914 - Exposure of sensitive information to an unauthorized actor
CVE-2025-68436
CWE-200 Medium
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120913 - Server-Side Request Forgery (SSRF)
CVE-2025-68437
CWE-918 Low
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120912 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-68454
CWE-94 Low
No
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU120911 - Improper input validation
CVE-2025-68456
CWE-20 High
Available
No
4.16.17, 5.8.21 05.01.2026 SB2026010560
#VU110085 - Improper input validation
CVE-2025-35939
CWE-20 Medium
No
Exploited
4.15.3, 5.7.5 03.06.2025 SB2025060309
#VU108656 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-46731
CWE-94 Low
Available
No
4.14.13, 5.6.15 05.05.2025 SB2025050549


Showing elements 81 - 100 out of 137