# cve.now: Craftcms

The newest entries naming Craftcms as an affected vendor (up to 200), of 175 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115934](https://cve.now/CVE-2026-115934.md): SQL injection leading to privilege escalation (CVSS 9.3)
- [CVE-2026-124431](https://cve.now/CVE-2026-124431.md): Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement (CVSS 5.3)
- [CVE-2026-124430](https://cve.now/CVE-2026-124430.md): Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle (CVSS 8.7)
- [CVE-2026-124429](https://cve.now/CVE-2026-124429.md): Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration (CVSS 8.7)
- [CVE-2026-124428](https://cve.now/CVE-2026-124428.md): Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg (CVSS 7.1)
- [CVE-2026-124427](https://cve.now/CVE-2026-124427.md): Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next (CVSS 9.3)
- [CVE-2026-124426](https://cve.now/CVE-2026-124426.md): Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field (CVSS 6.9)
- [CVE-2026-123491](https://cve.now/CVE-2026-123491.md): Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select (CVSS 8.8)
- [CVE-2026-123490](https://cve.now/CVE-2026-123490.md): Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass (CVSS 8.7)
- [CVE-2026-123489](https://cve.now/CVE-2026-123489.md): Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria (CVSS 7.1)
- [CVE-2026-123488](https://cve.now/CVE-2026-123488.md): Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint (CVSS 9.3)
- [CVE-2026-115938](https://cve.now/CVE-2026-115938.md): Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE (CVSS 8.7)
- [CVE-2026-115937](https://cve.now/CVE-2026-115937.md): Unauthenticated payment reuse allows unpaid orders to be marked as paid (CVSS 8.7)
- [CVE-2026-115935](https://cve.now/CVE-2026-115935.md): Control panel only API response emulation replaces "securityKey" and reaches server RCE (CVSS 8.7)
- [CVE-2026-112777](https://cve.now/CVE-2026-112777.md): Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE (CVSS 8.7)
- [CVE-2026-112776](https://cve.now/CVE-2026-112776.md): Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations (CVSS 9.3)
- [CVE-2026-112775](https://cve.now/CVE-2026-112775.md): Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password (CVSS 8.7)
- [CVE-2026-112774](https://cve.now/CVE-2026-112774.md): Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout (CVSS 8.7)
- [CVE-2026-112773](https://cve.now/CVE-2026-112773.md): Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection (CVSS 8.7)
- [CVE-2026-112772](https://cve.now/CVE-2026-112772.md): Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection (CVSS 8.7)
- [CVE-2026-112771](https://cve.now/CVE-2026-112771.md): Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters (CVSS 7.1)
- [CVE-2026-112770](https://cve.now/CVE-2026-112770.md): Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable (CVSS 8.7)
- [CVE-2026-109308](https://cve.now/CVE-2026-109308.md): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection (CVSS 8.7)
- [CVE-2026-109307](https://cve.now/CVE-2026-109307.md): Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification (CVSS 2.1)
- [CVE-2026-109306](https://cve.now/CVE-2026-109306.md): Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition (CVSS 6.0)
- [CVE-2026-109305](https://cve.now/CVE-2026-109305.md): Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every (CVSS 8.7)
- [CVE-2026-109304](https://cve.now/CVE-2026-109304.md): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument (CVSS 6.9)
- [CVE-2026-105985](https://cve.now/CVE-2026-105985.md): Authenticated RCE via render-components Entry Type overrides (CVSS 8.7)
- [CVE-2026-92594](https://cve.now/CVE-2026-92594.md): Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL (CVSS 8.7)
- [CVE-2026-92593](https://cve.now/CVE-2026-92593.md): Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution (CVSS 8.7)
- [CVE-2026-92592](https://cve.now/CVE-2026-92592.md): Craft CMS before 4.18.6 Remote Code Execution via signed cookie (CVSS 8.7)
- [CVE-2026-92591](https://cve.now/CVE-2026-92591.md): Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer (CVSS 8.2)
- [CVE-2026-92590](https://cve.now/CVE-2026-92590.md): Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields (CVSS 5.1)
- [CVE-2026-92589](https://cve.now/CVE-2026-92589.md): Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder (CVSS 5.3)
- [CVE-2026-55795](https://cve.now/CVE-2026-55795.md): Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass (CVSS 6.9)
- [CVE-2026-79987](https://cve.now/CVE-2026-79987.md): Low-privilege RCE through element-search eager loading (CVSS 8.7)
- [CVE-2026-86732](https://cve.now/CVE-2026-86732.md): Craft CMS before 5.10.12 Remote Code Execution via element-index (CVSS 8.7)
- [CVE-2026-86731](https://cve.now/CVE-2026-86731.md): Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController (CVSS 7.1)
- [CVE-2026-86730](https://cve.now/CVE-2026-86730.md): Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE (CVSS 8.7)
- [CVE-2026-79991](https://cve.now/CVE-2026-79991.md): Authenticated SQL Injection via nested eager-loading criteria (CVSS 7.1)
- [CVE-2026-79990](https://cve.now/CVE-2026-79990.md): GQL entry mutation \`siteId\` bypasses schema site scope, enabling cross-site content read/write/delete (CVSS 8.7)
- [CVE-2026-79989](https://cve.now/CVE-2026-79989.md): Arbitrary user password reset leading to administrator account takeover (CVSS 8.7)
- [CVE-2026-84802](https://cve.now/CVE-2026-84802.md): Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController (CVSS 5.3)
- [CVE-2026-84801](https://cve.now/CVE-2026-84801.md): Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers (CVSS 8.7)
- [CVE-2026-84800](https://cve.now/CVE-2026-84800.md): Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file (CVSS 7.1)
- [CVE-2026-84799](https://cve.now/CVE-2026-84799.md): Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations (CVSS 5.3)
- [CVE-2026-84798](https://cve.now/CVE-2026-84798.md): Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite (CVSS 7.1)
- [CVE-2026-84797](https://cve.now/CVE-2026-84797.md): Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate (CVSS 5.3)
- [CVE-2026-84796](https://cve.now/CVE-2026-84796.md): Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass (CVSS 8.7)
- [CVE-2026-84795](https://cve.now/CVE-2026-84795.md): Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance (CVSS 9.2)
- [CVE-2026-84794](https://cve.now/CVE-2026-84794.md): Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset (CVSS 7.1)
- [CVE-2026-84793](https://cve.now/CVE-2026-84793.md): Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name (CVSS 4.8)
- [CVE-2026-84792](https://cve.now/CVE-2026-84792.md): Craft CMS before 5.10.11 Broken Access Control via element-indexes (CVSS 5.3)
- [CVE-2026-79988](https://cve.now/CVE-2026-79988.md): Authenticated RCE through Twig sandbox escape (CVSS 8.7)
- [CVE-2026-78416](https://cve.now/CVE-2026-78416.md): Authenticated RCE via \`condition.config\` JSON cleanse bypass (CVSS 8.7)
- [CVE-2026-72787](https://cve.now/CVE-2026-72787.md): Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name (CVSS 5.1)
- [CVE-2026-72786](https://cve.now/CVE-2026-72786.md): Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset (CVSS 7.1)
- [CVE-2026-72785](https://cve.now/CVE-2026-72785.md): Craft CMS before 5.10.6 Authorization Bypass via structures/move-element (CVSS 9.3)
- [CVE-2026-72784](https://cve.now/CVE-2026-72784.md): Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation (CVSS 6.9)
- [CVE-2026-72783](https://cve.now/CVE-2026-72783.md): Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained (CVSS 6.9)
- [CVE-2026-72782](https://cve.now/CVE-2026-72782.md): Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak (CVSS 7.1)
- [CVE-2026-72781](https://cve.now/CVE-2026-72781.md): Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape (CVSS 8.7)
- [CVE-2026-72780](https://cve.now/CVE-2026-72780.md): Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey (CVSS 7.1)
- [CVE-2026-72779](https://cve.now/CVE-2026-72779.md): Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject (CVSS 8.7)
- [CVE-2026-72778](https://cve.now/CVE-2026-72778.md): Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config (CVSS 8.7)
- [CVE-2026-50282](https://cve.now/CVE-2026-50282.md): Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves (CVSS 4.9)
- [CVE-2026-50281](https://cve.now/CVE-2026-50281.md): Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements (CVSS 7.1)
- [CVE-2026-50280](https://cve.now/CVE-2026-50280.md): Craft CMS: Authorization bypass in \`entries/move-to-section\` via missing target-section save check (CVSS 6.0)
- [CVE-2026-50279](https://cve.now/CVE-2026-50279.md): Craft CMS: Authorship spoofing in \`entries/save-entry\` via pre-check/post-mutation authorization gap (CVSS 7.6)
- [CVE-2026-55794](https://cve.now/CVE-2026-55794.md): Craft CMS: Potential authenticated Remote Code Execution via referrer redirect (CVSS 8.7)
- [CVE-2026-55792](https://cve.now/CVE-2026-55792.md): Craft CMS: Sensitive File Disclosure / Server-Side File Read (CVSS 6.0)
- [CVE-2026-55791](https://cve.now/CVE-2026-55791.md): Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs (CVSS 6.9)
- [CVE-2026-55790](https://cve.now/CVE-2026-55790.md): Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget (CVSS 7.4)
- [CVE-2026-50284](https://cve.now/CVE-2026-50284.md): Craft CMS: Missing peer-permission check in \`AssetsController::actionDeleteFolder\` allows deletion of other users' assets (CVSS 7.1)
- [CVE-2026-50283](https://cve.now/CVE-2026-50283.md): Craft CMS: Unauthorized Deletion of Source Assets During File Replacement (CVSS 5.3)
- [CVE-2026-55793](https://cve.now/CVE-2026-55793.md): Craft CMS: Stored XSS via Structure entry title in table view (CVSS 5.9)
- [CVE-2026-56394](https://cve.now/CVE-2026-56394.md): Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter (CVSS 7.1)
- [CVE-2026-56393](https://cve.now/CVE-2026-56393.md): Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options (CVSS 4.6)
- [CVE-2026-56385](https://cve.now/CVE-2026-56385.md): Craft CMS - Authorization Bypass in assets/preview-file Endpoint (CVSS 5.3)
- [CVE-2026-56384](https://cve.now/CVE-2026-56384.md): Craft CMS - Missing Authorization in assets/preview-thumb Endpoint (CVSS 5.3)
- [CVE-2026-56383](https://cve.now/CVE-2026-56383.md): Craft CMS - Stored XSS in Table Field via Row Heading Column Type (CVSS 4.6)
- [CVE-2026-56382](https://cve.now/CVE-2026-56382.md): Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController (CVSS 8.6)
- [CVE-2026-56381](https://cve.now/CVE-2026-56381.md): Craft CMS - Stored XSS via User Group Name in User Permissions Page (CVSS 4.6)
- [CVE-2026-44011](https://cve.now/CVE-2026-44011.md): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6)
- [CVE-2026-44012](https://cve.now/CVE-2026-44012.md): Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure (CVSS 7.1)
- [CVE-2026-44010](https://cve.now/CVE-2026-44010.md): Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure (CVSS 7.1)
- [CVE-2026-41130](https://cve.now/CVE-2026-41130.md): Craft CMS has a host header injection leading to SSRF via resource-js endpoint (CVSS 5.5)
- [CVE-2026-41129](https://cve.now/CVE-2026-41129.md): Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations (CVSS 5.5)
- [CVE-2026-41128](https://cve.now/CVE-2026-41128.md): Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action (CVSS 5.3)
- [CVE-2026-32272](https://cve.now/CVE-2026-32272.md): Craft Commerce: Blind SQL Injection via hasVariant/hasProduct (CVSS 8.7)
- [CVE-2026-32271](https://cve.now/CVE-2026-32271.md): Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget (CVSS 7.7)
- [CVE-2026-32270](https://cve.now/CVE-2026-32270.md): Craft Commerce: Unauthenticated information disclosure in \`commerce/payments/pay\` can leak some customer order data on anonymous payments (CVSS 1.7)
- [CVE-2026-33162](https://cve.now/CVE-2026-33162.md): Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions (CVSS 4.9)
- [CVE-2026-33161](https://cve.now/CVE-2026-33161.md): Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users (CVSS 1.3)
- [CVE-2026-33160](https://cve.now/CVE-2026-33160.md): Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL (CVSS 2.7)
- [CVE-2026-33159](https://cve.now/CVE-2026-33159.md): Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users (CVSS 6.9)
- [CVE-2026-33158](https://cve.now/CVE-2026-33158.md): Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) (CVSS 4.9)
- [CVE-2026-33157](https://cve.now/CVE-2026-33157.md): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6)
- [CVE-2026-33051](https://cve.now/CVE-2026-33051.md): Craft CMS Vulnerable to Stored XSS in Revision Context Menu (CVSS 5.3)
- [CVE-2026-32268](https://cve.now/CVE-2026-32268.md): Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability (CVSS 8.7)
- [CVE-2026-32266](https://cve.now/CVE-2026-32266.md): Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability (CVSS 2.4)
- [CVE-2026-32265](https://cve.now/CVE-2026-32265.md): Amazon S3 for Craft CMS has an Information Disclosure vulnerability (CVSS 6.9)
- [CVE-2026-32267](https://cve.now/CVE-2026-32267.md): Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController-\>actionImpersonateWithToken() (CVSS 7.7)
- [CVE-2026-32264](https://cve.now/CVE-2026-32264.md): Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController (CVSS 8.6)
- [CVE-2026-32263](https://cve.now/CVE-2026-32263.md): Craft CMS vulnerable to behavior injection RCE via EntryTypesController (CVSS 8.6)
- [CVE-2026-32262](https://cve.now/CVE-2026-32262.md): Craft CMS has a Path Traversal Vulnerability in AssetsController (CVSS 5.3)
- [CVE-2026-32261](https://cve.now/CVE-2026-32261.md): RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin (CVSS 8.5)
- [CVE-2026-31867](https://cve.now/CVE-2026-31867.md): Craft Commerce has a Potential IDOR in Commerce carts (CVSS 6.3)
- [CVE-2026-31859](https://cve.now/CVE-2026-31859.md): Craft has Reflective XSS via incomplete return URL sanitization (CVSS 6.9)
- [CVE-2026-31858](https://cve.now/CVE-2026-31858.md): CraftCMS's \`ElementSearchController\` Affected by Blind SQL Injection (CVSS 8.7)
- [CVE-2026-31857](https://cve.now/CVE-2026-31857.md): CraftCMS has an RCE vulnerability via relational conditionals in the control panel (CVSS 8.1)
- [CVE-2026-29177](https://cve.now/CVE-2026-29177.md): Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout (CVSS 1.9)
- [CVE-2026-29176](https://cve.now/CVE-2026-29176.md): Craft Commerce has Stored XSS in Inventory Location Name (CVSS 4.8)
- [CVE-2026-29175](https://cve.now/CVE-2026-29175.md): Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking (CVSS 8.6)
- [CVE-2026-29174](https://cve.now/CVE-2026-29174.md): Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting (CVSS 8.7)
- [CVE-2026-29173](https://cve.now/CVE-2026-29173.md): Craft Commerce has Stored XSS while updating Order Status from Orders Table (CVSS 1.9)
- [CVE-2026-29172](https://cve.now/CVE-2026-29172.md): Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting (CVSS 8.7)
- [CVE-2026-29113](https://cve.now/CVE-2026-29113.md): Craft has a potential information disclosure vulnerability in preview tokens (CVSS 2.3)
- [CVE-2026-29069](https://cve.now/CVE-2026-29069.md): Craft has an unauthenticated activation email trigger with potential user enumeration (CVSS 6.9)
- [CVE-2026-28784](https://cve.now/CVE-2026-28784.md): Craft is affected by potential authenticated Remote Code Execution via Twig SSTI (CVSS 8.6)
- [CVE-2026-28783](https://cve.now/CVE-2026-28783.md): Craft has a Twig Function Blocklist Bypass (CVSS 9.4)
- [CVE-2026-28782](https://cve.now/CVE-2026-28782.md): Craft has a Permission Bypass and IDOR in Duplicate Entry Action (CVSS 5.3)
- [CVE-2026-28781](https://cve.now/CVE-2026-28781.md): Craft Affected by Entries Authorship Spoofing via Mass Assignment (CVSS 7.1)
- [CVE-2026-28697](https://cve.now/CVE-2026-28697.md): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates (CVSS 9.4)
- [CVE-2026-28696](https://cve.now/CVE-2026-28696.md): Craft affected by IDOR via GraphQL @parseRefs (CVSS 8.7)
- [CVE-2026-28695](https://cve.now/CVE-2026-28695.md): Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget (CVSS 7.5)
- [CVE-2026-27129](https://cve.now/CVE-2026-27129.md): Cloud Metadata SSRF Protection Bypass via IPv6 Resolution (CVSS 5.7)
- [CVE-2026-27128](https://cve.now/CVE-2026-27128.md): Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit (CVSS 6.9)
- [CVE-2026-27127](https://cve.now/CVE-2026-27127.md): Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding (CVSS 7.0)
- [CVE-2026-27126](https://cve.now/CVE-2026-27126.md): Craft CMS has Stored XSS in Table Field via "HTML" Column Type (CVSS 5.9)
- [CVE-2026-25498](https://cve.now/CVE-2026-25498.md): Craft has a potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6)
- [CVE-2026-25497](https://cve.now/CVE-2026-25497.md): Craft has a GraphQL Asset Mutation Privilege Escalation (CVSS 8.6)
- [CVE-2026-25496](https://cve.now/CVE-2026-25496.md): Craft has a stored XSS in Number Prefix & Suffix Fields (CVSS 4.8)
- [CVE-2026-25495](https://cve.now/CVE-2026-25495.md): Craft has a SQL Injection in Element Indexes via criteria\[orderBy\] (CVSS 8.7)
- [CVE-2026-25494](https://cve.now/CVE-2026-25494.md): Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation (CVSS 6.9)
- [CVE-2026-25493](https://cve.now/CVE-2026-25493.md): Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect (CVSS 6.9)
- [CVE-2026-25492](https://cve.now/CVE-2026-25492.md): Craft has a save\_images\_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host (CVSS 5.3)
- [CVE-2026-25491](https://cve.now/CVE-2026-25491.md): Craft has a Stored XSS in Entry Types Name (CVSS 1.9)
- [CVE-2020-37071](https://cve.now/CVE-2020-37071.md): CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution (CVSS 9.3)
- [CVE-2026-25522](https://cve.now/CVE-2026-25522.md): Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25490](https://cve.now/CVE-2026-25490.md): Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25489](https://cve.now/CVE-2026-25489.md): Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25488](https://cve.now/CVE-2026-25488.md): Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25487](https://cve.now/CVE-2026-25487.md): Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25486](https://cve.now/CVE-2026-25486.md): Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation (CVSS 6.1)
- [CVE-2026-25485](https://cve.now/CVE-2026-25485.md): Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation (CVSS 6.2)
- [CVE-2026-25484](https://cve.now/CVE-2026-25484.md): Craft Commerce has Stored XSS in Product Type Name (CVSS 4.8)
- [CVE-2026-25483](https://cve.now/CVE-2026-25483.md): Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration (CVSS 6.2)
- [CVE-2026-25482](https://cve.now/CVE-2026-25482.md): Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) (CVSS 6.2)
- [CVE-2025-68456](https://cve.now/CVE-2025-68456.md): Unauthenticated Craft CMS users can trigger a database backup (CVSS 7.0)
- [CVE-2025-68455](https://cve.now/CVE-2025-68455.md): Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6)
- [CVE-2025-68454](https://cve.now/CVE-2025-68454.md): Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI (CVSS 5.2)
- [CVE-2025-68437](https://cve.now/CVE-2025-68437.md): Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation (CVSS 5.0)
- [CVE-2025-68436](https://cve.now/CVE-2025-68436.md): Craft CMS vulnerable to potential information disclosure via unchecked asset relocation (CVSS 4.9)
- [CVE-2025-57811](https://cve.now/CVE-2025-57811.md): Craft Potential Remote Code Execution via Twig SSTI (CVSS 6.1)
- [CVE-2025-54417](https://cve.now/CVE-2025-54417.md): Craft contains a theoretical bypass for CVE-2025-23209 (CVSS 5.2)
- [CVE-2025-46731](https://cve.now/CVE-2025-46731.md): Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI (CVSS 7.3)
- [CVE-2025-32432](https://cve.now/CVE-2025-32432.md): Craft CMS Allows Remote Code Execution (CVSS 10.0, KEV)
- [CVE-2025-23209](https://cve.now/CVE-2025-23209.md): Potential RCE with a compromised security key in craft/cms (CVSS 8.1, KEV)
- [CVE-2024-56145](https://cve.now/CVE-2024-56145.md): RCE when PHP \`register\_argc\_argv\` config setting is enabled in craftcms/cms (CVSS 9.3, KEV)
- [CVE-2024-52291](https://cve.now/CVE-2024-52291.md): Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution (CVSS 8.5)
- [CVE-2024-52292](https://cve.now/CVE-2024-52292.md): Craft Allows Attackers to Read Arbitrary System Files (CVSS 7.7)
- [CVE-2024-52293](https://cve.now/CVE-2024-52293.md): Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI (CVSS 7.2)
- [CVE-2024-45406](https://cve.now/CVE-2024-45406.md): Craft CMS stored XSS in breadcrumb list and title fields (CVSS 5.5)
- [CVE-2024-41800](https://cve.now/CVE-2024-41800.md): Craft CMS Allows TOTP Token To Stay Valid After Use (CVSS 4.8)
- [CVE-2024-21622](https://cve.now/CVE-2024-21622.md): Craft CMS Privilege Escalation (CVSS 5.4)
- [CVE-2023-41892](https://cve.now/CVE-2023-41892.md): Craft CMS Remote Code Execution vulnerability (CVSS 10.0)
- [CVE-2023-40035](https://cve.now/CVE-2023-40035.md): Craft CMS vulnerable to Remote Code Execution via validatePath bypass (CVSS 7.2)
- [CVE-2023-33195](https://cve.now/CVE-2023-33195.md): Craft CMS XSS in RSS widget feed (CVSS 5.0)
- [CVE-2023-33194](https://cve.now/CVE-2023-33194.md): CraftCMS stored XSS in Quick Post widget error message (CVSS 3.7)
- [CVE-2023-33196](https://cve.now/CVE-2023-33196.md): Craft CMS stored XSS in review volume (CVSS 5.5)
- [CVE-2023-33197](https://cve.now/CVE-2023-33197.md): Craft CMS stored XSS in indexedVolumes (CVSS 5.5)
- [CVE-2023-32679](https://cve.now/CVE-2023-32679.md): Remote Code Execution via unrestricted file extension in Craft CMS (CVSS 7.2)
- [CVE-2023-31144](https://cve.now/CVE-2023-31144.md): Craft CMS vulnerable to cross site scripting in RSS feed widget (CVSS 6.1)
- [CVE-2023-23927](https://cve.now/CVE-2023-23927.md): Craft CMS stored cross-site scripting vulnerability (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/craftcms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.