[ Vendor · 4 CVEs ]
Sitecore
CVEs affecting Sitecore published in the last 30 days, plus any Sitecore CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-53690 | 3 Sep 2025 | CVSS 9.0 | Sitecore Multiple Products Deserialization of Untrusted DataDeserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This… | Exploited |
| CVE-2021-42237 | 5 Nov 2021 | CVSS 9.8 | Sitecore XP Remote Command ExecutionSitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve… | Exploited |
| CVE-2019-9874 | 31 May 2019 | CVSS 9.8 | Sitecore CMS and Experience Platform (XP) DeserializationDeserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2… | ExploitedFix |
| CVE-2019-9875 | 31 May 2019 | CVSS 8.8 | Sitecore CMS and Experience Platform (XP) DeserializationDeserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by… | ExploitedFix |