Octobercms vulnerabilities
41 CVEs and advisories name Octobercms as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-49400October CMS: PHP Object Injection via Backend Widget Session Storage
- CVE-2026-46696October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
- CVE-2026-29179October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
- CVE-2026-27937October: Reflected XSS via DataTable Form Widget
- CVE-2026-26274October: Safe Mode Bypass via Twig Database Write Operations
- CVE-2026-26067October: Safe Mode Bypass via CSS Preprocessor Compilers
- CVE-2026-25133October CMS has Stored XSS via SVG Filter Bypass
- CVE-2026-25125October CMS: Environment Variable Exfiltration via INI Parser Interpolation
- CVE-2026-24907October CMS has Stored XSS via Event Log Mail Preview
- CVE-2026-24906October CMS has Stored XSS in its Backend Editor Markup Classes
- CVE-2026-22692October CMS: Twig Sandbox Bypass via Collection Methods
- CVE-2025-61674October CMS Vulnerable to Stored XSS via Editor and Branding Styles
- CVE-2025-61676October CMS Vulnerable to Stored XSS via Branding Styles
- CVE-2024-51991October CMS Allows Unprotected SVG Rename in Media Manager
- CVE-2024-25637Reflected XSS via X-October-Request-Handler Header
- CVE-2024-24764October Open Redirect for Administrator Accounts
- CVE-2023-44381October CMS safe mode bypass using Page template injection
- CVE-2023-44382October CMS safe mode bypass using Twig sandbox escape
- CVE-2023-44383October CMS stored XSS by authenticated backend user with improper configuration
- CVE-2022-35944October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)
- CVE-2022-24800Race Condition in October CMS upload process
- CVE-2022-23655Missing server signature validation in OctoberCMS
- CVE-2022-21705Authenticated remote code execution in octobercms
- CVE-2021-32649Authenticated file write leads to remote code execution in october/system
- CVE-2021-32650Arbitrary code execution in october/system
- CVE-2021-41126Deleted Admin Can Sign In to Admin Interface
- CVE-2021-29487Authentication bypass in Octobercms
- CVE-2021-32648Account Takeover in Octobercms
- CVE-2021-21264Bypass of fix for CVE-2020-26231, Twig sandbox escape
- CVE-2021-21265October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers