[ Vendor · 17 CVEs ]
craftcms
CVEs affecting craftcms published in the last 30 days, plus any craftcms CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112777 | 19 Oct 2026 | CVSS 7.2 | craftcms cmsCraft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are… | |
| CVE-2026-112770 | 19 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string… | |
| CVE-2026-112771 | 19 Oct 2026 | CVSS 6.5 | craftcms cmsCraft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index… | |
| CVE-2026-112772 | 19 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig… | |
| CVE-2026-112773 | 19 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig… | |
| CVE-2026-112774 | 19 Oct 2026 | CVSS 7.2 | craftcms cmsCraft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by… | |
| CVE-2026-112775 | 19 Oct 2026 | CVSS 7.5 | craftcms cmsCraft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because… | |
| CVE-2026-112776 | 19 Oct 2026 | CVSS 9.8 | craftcms cmsCraft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites'… | |
| CVE-2026-109307 | 12 Oct 2026 | CVSS 4.7 | craftcms cmsCraft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a… | |
| CVE-2026-109308 | 12 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to… | |
| CVE-2026-109304 | 12 Oct 2026 | CVSS 4.9 | craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does… | |
| CVE-2026-109305 | 12 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and… | |
| CVE-2026-109306 | 12 Oct 2026 | CVSS 5.9 | craftcms cmsCraft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any… | |
| CVE-2026-105985 | 6 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any… | |
| CVE-2025-32432 | 25 Apr 2025 | CVSS 10.0 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before… | ExploitedFix |
| CVE-2025-23209 | 18 Jan 2025 | CVSS 8.1 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE)… | ExploitedFix |
| CVE-2024-56145 | 18 Dec 2024 | CVSS 9.8 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this… | ExploitedFix |