Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-92592Craft CMS before 4.18.6 Remote Code Execution via signed cookie
- CVE-2026-92591Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
- CVE-2026-92590Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
- CVE-2026-92589Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
- CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
- CVE-2026-79987Low-privilege RCE through element-search eager loading
- CVE-2026-86732Craft CMS before 5.10.12 Remote Code Execution via element-index
- CVE-2026-86731Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
- CVE-2026-86730Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
- CVE-2026-79991Authenticated SQL Injection via nested eager-loading criteria
- CVE-2026-79990GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
- CVE-2026-79989Arbitrary user password reset leading to administrator account takeover
- CVE-2026-84802Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
- CVE-2026-84801Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
- CVE-2026-84800Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
- CVE-2026-84799Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
- CVE-2026-84798Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
- CVE-2026-84797Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
- CVE-2026-84796Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
- CVE-2026-84795Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
- CVE-2026-84794Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
- CVE-2026-84793Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
- CVE-2026-84792Craft CMS before 5.10.11 Broken Access Control via element-indexes
- CVE-2026-79988Authenticated RCE through Twig sandbox escape
- CVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypass
- CVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
- CVE-2026-72786Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
- CVE-2026-72785Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
- CVE-2026-72784Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
- CVE-2026-72783Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained