# cve.now: Octobercms

The newest entries naming Octobercms as an affected vendor (up to 200), of 41 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-49400](https://cve.now/CVE-2026-49400.md): October CMS: PHP Object Injection via Backend Widget Session Storage (CVSS 3.3)
- [CVE-2026-46696](https://cve.now/CVE-2026-46696.md): October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls (CVSS 3.3)
- [CVE-2026-29179](https://cve.now/CVE-2026-29179.md): October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations (CVSS 3.3)
- [CVE-2026-27937](https://cve.now/CVE-2026-27937.md): October: Reflected XSS via DataTable Form Widget (CVSS 3.1)
- [CVE-2026-26274](https://cve.now/CVE-2026-26274.md): October: Safe Mode Bypass via Twig Database Write Operations (CVSS 6.6)
- [CVE-2026-26067](https://cve.now/CVE-2026-26067.md): October: Safe Mode Bypass via CSS Preprocessor Compilers (CVSS 4.9)
- [CVE-2026-25133](https://cve.now/CVE-2026-25133.md): October CMS has Stored XSS via SVG Filter Bypass (CVSS 4.8)
- [CVE-2026-25125](https://cve.now/CVE-2026-25125.md): October CMS: Environment Variable Exfiltration via INI Parser Interpolation (CVSS 4.9)
- [CVE-2026-24907](https://cve.now/CVE-2026-24907.md): October CMS has Stored XSS via Event Log Mail Preview (CVSS 5.1)
- [CVE-2026-24906](https://cve.now/CVE-2026-24906.md): October CMS has Stored XSS in its Backend Editor Markup Classes (CVSS 5.1)
- [CVE-2026-22692](https://cve.now/CVE-2026-22692.md): October CMS: Twig Sandbox Bypass via Collection Methods (CVSS 4.9)
- [CVE-2025-61674](https://cve.now/CVE-2025-61674.md): October CMS Vulnerable to Stored XSS via Editor and Branding Styles (CVSS 6.1)
- [CVE-2025-61676](https://cve.now/CVE-2025-61676.md): October CMS Vulnerable to Stored XSS via Branding Styles (CVSS 6.1)
- [CVE-2024-51991](https://cve.now/CVE-2024-51991.md): October CMS Allows Unprotected SVG Rename in Media Manager (CVSS 1.1)
- [CVE-2024-25637](https://cve.now/CVE-2024-25637.md): Reflected XSS via X-October-Request-Handler Header (CVSS 3.1)
- [CVE-2024-24764](https://cve.now/CVE-2024-24764.md): October Open Redirect for Administrator Accounts (CVSS 3.5)
- [CVE-2023-44381](https://cve.now/CVE-2023-44381.md): October CMS safe mode bypass using Page template injection (CVSS 4.9)
- [CVE-2023-44382](https://cve.now/CVE-2023-44382.md): October CMS safe mode bypass using Twig sandbox escape (CVSS 9.1)
- [CVE-2023-44383](https://cve.now/CVE-2023-44383.md): October CMS stored XSS by authenticated backend user with improper configuration (CVSS 5.4)
- [CVE-2022-35944](https://cve.now/CVE-2022-35944.md): October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) (CVSS 6.2)
- [CVE-2022-24800](https://cve.now/CVE-2022-24800.md): Race Condition in October CMS upload process (CVSS 8.1)
- [CVE-2022-23655](https://cve.now/CVE-2022-23655.md): Missing server signature validation in OctoberCMS (CVSS 4.8)
- [CVE-2022-21705](https://cve.now/CVE-2022-21705.md): Authenticated remote code execution in octobercms (CVSS 7.2)
- [CVE-2021-32649](https://cve.now/CVE-2021-32649.md): Authenticated file write leads to remote code execution in october/system (CVSS 8.8)
- [CVE-2021-32650](https://cve.now/CVE-2021-32650.md): Arbitrary code execution in october/system (CVSS 8.8)
- [CVE-2021-41126](https://cve.now/CVE-2021-41126.md): Deleted Admin Can Sign In to Admin Interface (CVSS 7.2)
- [CVE-2021-29487](https://cve.now/CVE-2021-29487.md): Authentication bypass in Octobercms (CVSS 7.4)
- [CVE-2021-32648](https://cve.now/CVE-2021-32648.md): Account Takeover in Octobercms (CVSS 8.2, KEV)
- [CVE-2021-21264](https://cve.now/CVE-2021-21264.md): Bypass of fix for CVE-2020-26231, Twig sandbox escape (CVSS 5.2)
- [CVE-2021-21265](https://cve.now/CVE-2021-21265.md): October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers (CVSS 6.8)
- [CVE-2020-26231](https://cve.now/CVE-2020-26231.md): Bypass of fix for CVE-2020-15247, Twig sandbox escape (CVSS 5.2)
- [CVE-2020-15249](https://cve.now/CVE-2020-15249.md): Stored XSS by authenticated backend user with access to upload files (CVSS 2.8)
- [CVE-2020-15248](https://cve.now/CVE-2020-15248.md): Privilege escalation by backend users assigned to the default "Publisher" system role (CVSS 4.0)
- [CVE-2020-15247](https://cve.now/CVE-2020-15247.md): Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. (CVSS 5.2)
- [CVE-2020-15246](https://cve.now/CVE-2020-15246.md): Local File Inclusion by unauthenticated users (CVSS 7.5)
- [CVE-2020-15128](https://cve.now/CVE-2020-15128.md): Reliance on Cookies without validation in OctoberCMS (CVSS 6.1)
- [CVE-2020-5299](https://cve.now/CVE-2020-5299.md): Potential CSV Injection vector in OctoberCMS (CVSS 4.0)
- [CVE-2020-5296](https://cve.now/CVE-2020-5296.md): Arbitrary File Deletion vulnerability in OctoberCMS (CVSS 6.2)
- [CVE-2020-5297](https://cve.now/CVE-2020-5297.md): Upload whitelisted files to any directory in OctoberCMS (CVSS 3.4)
- [CVE-2020-5298](https://cve.now/CVE-2020-5298.md): Reflected XSS when importing CSV in OctoberCMS (CVSS 4.0)
- [CVE-2020-5295](https://cve.now/CVE-2020-5295.md): Local File read vulnerability in OctoberCMS (CVSS 4.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/octobercms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.