- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 24 · 1 critical, 7 high, 9 medium, 7 low
- Registry
- Packagist
Advisories 24
- CVE-2026-49400Low 3.3
October CMS: PHP Object Injection via Backend Widget Session Storage
Affected: fixed in 3.7.17; from 4.0.0, fixed in 4.2.23.
- CVE-2026-46696Low 3.3
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
Affected: fixed in 3.7.17; from 4.0.0, fixed in 4.2.23.
- CVE-2026-29179Low 3.3
October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Affected: from 4.0.0, fixed in 4.1.16; fixed in 3.7.16.
- CVE-2026-27937Low 3.1
October: Reflected XSS via DataTable Form Widget
Affected: fixed in 3.7.16; from 4.0.0.
- CVE-2026-26067Medium 4.9
October: Safe Mode Bypass via CSS Preprocessor Compilers
Affected: fixed in 3.7.14; from 4.0.0, fixed in 4.1.10.
- CVE-2026-24907Medium 5.1
October CMS has Stored XSS via Event Log Mail Preview
Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14.
- CVE-2026-24906Medium 5.1
October CMS has Stored XSS in its Backend Editor Markup Classes
Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14.
- CVE-2025-61674Medium 6.1
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Affected: fixed in 3.7.13; from 4.0.0, fixed in 4.0.12.
- CVE-2025-61676Medium 6.1
October CMS Vulnerable to Stored XSS via Branding Styles
Affected: fixed in 3.7.13; from 4.0.0, fixed in 4.0.12.
- CVE-2024-51991Low 1.1
October CMS Allows Unprotected SVG Rename in Media Manager
Affected: fixed in 3.7.5.
- CVE-2024-25637Low 3.1
Reflected XSS via X-October-Request-Handler Header
Affected: from 3.2, fixed in 3.5.15.
- CVE-2024-24764Low 3.5
October Open Redirect for Administrator Accounts
Affected: from 3.2, fixed in 3.5.15.
- CVE-2023-44381Medium 4.9
October CMS safe mode bypass using Page template injection
Affected: from 3.0.0, fixed in 3.4.15.
- CVE-2023-44382Critical 9.1
October CMS safe mode bypass using Twig sandbox escape
Affected: from 3.0.0, fixed in 3.4.15.
- CVE-2023-44383Medium 5.4
October CMS stored XSS by authenticated backend user with improper configuration
Affected: from 3.0.0, fixed in 3.5.2.
Show all 24 advisoriesShow fewer advisories
- CVE-2022-35944Medium 6.2
October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)
Affected: from 2.0.0, fixed in 2.2.34; from 3.0.0, fixed in 3.0.66.
- CVE-2022-24800High 8.1
Race Condition in October CMS upload process
Affected: fixed in 1.0.476; from 1.1.0, fixed in 1.1.12; from 2.0.0, fixed in 2.2.15.
- CVE-2022-23655Medium 4.8
Missing server signature validation in OctoberCMS
Affected: from 1.1.0, fixed in 1.1.11; fixed in 1.0.475.
- CVE-2022-21705High 7.2
Authenticated remote code execution in octobercms
Affected: fixed in 1.0.474; from 1.1.0, fixed in 1.1.10; from 2.0.0, fixed in 2.1.27.
- CVE-2021-32649High 8.8
Authenticated file write leads to remote code execution in october/system
Affected: from 1.1.0, fixed in 1.1.6; fixed in 1.0.473.
- CVE-2021-32650High 8.8
Arbitrary code execution in october/system
Affected: from 1.1.0, fixed in 1.1.6; fixed in 1.0.473.
- CVE-2021-41126High 7.2
Deleted Admin Can Sign In to Admin Interface
Affected: from 2.1.0, fixed in 2.1.12.
- CVE-2021-29487High 7.4
Authentication bypass in Octobercms
Affected: fixed in 1.0.472; from 1.1.1, fixed in 1.1.5.
- CVE-2021-32648High 8.2 · KEV
Account Takeover in Octobercms
Affected: fixed in 1.0.472; from 1.1.1, fixed in 1.1.5.