Known vulnerabilities in Craft CMS - page 6

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144283 - Missing Authorization
CVE-2026-84801
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144282 - Missing Authorization
CVE-2026-84800
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144281 - Improper Authorization
CVE-2026-84799
CWE-285 Low
No
No
99.99.1 19.08.2026 SB2026081959
#VU139972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-72787
CWE-79 Low
No
No
5.10.8 29.07.2026 SB2026072925
#VU139971 - Improper Authorization
CVE-2026-72786
CWE-285 Low
No
No
5.10.8 29.07.2026 SB2026072925
#VU139970 - Incorrect Authorization
CVE-2026-72785
CWE-863 Low
No
No
5.10.6 29.07.2026 SB2026072922
#VU139969 - Server-Side Request Forgery (SSRF)
CVE-2026-72784
CWE-918 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139968 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-72783
CWE-22 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139967 - Exposure of resource to wrong sphere
CVE-2026-72782
CWE-668 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139966 - Protection Mechanism Failure
CVE-2026-72781
CWE-693 Medium
No
No
4.18.3, 5.10.7 29.07.2026 SB2026072924
#VU139965 - Authentication Bypass by Capture-replay
CVE-2026-72780
CWE-294 High
No
No
5.10.5 29.07.2026 SB2026072923
#VU139964 - Incomplete List of Disallowed Inputs
CVE-2026-72779
CWE-184 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139963 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-72778
CWE-915 Medium
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU134656 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-56393
CWE-79 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134655 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-28697
CWE-1336 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134654 - Incomplete List of Disallowed Inputs
CVE-2026-28783
CWE-184 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134653 - Improper Access Control
CVE-2026-28696
CWE-284 Medium
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134652 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-28781
CWE-915 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU134651 - Authorization Bypass Through User-Controlled Key
CVE-2026-28782
CWE-639 Low
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU123019 - Improper Privilege Management
CVE-2026-25497
CWE-269 Medium
No
No
4.17.0, 5.9.0 18.02.2026 SB2026021831


Showing elements 101 - 120 out of 142