Composer craftcms/cms has 127 known advisories in the phpwarden feed, 4 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-32432 KEV | Craft CMS Allows Remote Code Execution | critical | 10.0 | >=3.0.0-RC1 and <3.9.15 or >=4.0.0-RC1 and <4.14.15 or >=5.0.0-RC1 and <5.6.17 | 3.9.15, 4.14.15, 5.6.17 |
| CVE-2024-56145 KEV | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical | 9.8 | >=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.13.2 or >=3.0.0 and <3.9.14 | 5.5.2, 4.13.2, 3.9.14 |
| CVE-2025-23209 KEV | Craft CMS has a potential RCE with a compromised security key | high | 8.0 | >=5.0.0-RC1 and <5.5.8 or >=4.0.0-RC1 and <4.13.8 | 5.5.8, 4.13.8 |
| CVE-2025-35939 KEV | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium | 5.3 | >=5.0.0-alpha.1 and <5.7.5 or <4.15.3 | 5.7.5, 4.15.3 |
| CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability | critical | 10.0 | >=4.0.0-RC1 and <4.4.15 | 4.4.15 |
| CVE-2024-37843 | Craft CMS SQL injection vulnerability via the GraphQL API endpoint | critical | 9.8 | <=3.7.31 | – |
| CVE-2026-32267 | Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | high | 0.0 | >=4.0.0-RC1 and <4.17.6 or >=5.0.0-RC1 and <5.9.12 | 4.17.6, 5.9.12 |
| CVE-2022-29933 | Improper account password reset in Craft CMS | high | 8.8 | <3.7.36 | 3.7.36 |
| CVE-2018-20418 | Craft CMS Cross-site Scripting (XSS) Vulnerability | medium | 4.8 | <=3.0.25 | – |
| CVE-2021-27903 | Craft CMS Remote Code Injection | critical | 9.8 | <3.6.7 | 3.6.7 |
| CVE-2017-9516 | Craft CMS XSS Vulnerability | medium | 5.4 | <2.6.2982 | 2.6.2982 |
| CVE-2023-40035 | Craft CMS vulnerable to Remote Code Execution via validatePath bypass | high | 7.2 | >=4.0.0-RC1 and <4.4.15 or >=3.0.0 and <3.8.15 | 4.4.15, 3.8.15 |
| CVE-2018-3814 | Craft CMS PHP Code Injection Vulnerability | high | 8.8 | <=2.6.3000 | – |
| CVE-2023-32679 | Craft CMS vulnerable to Remote Code Execution via unrestricted file extension | high | 7.2 | >=4.0.0 and <4.4.6 | 4.4.6 |
| CVE-2019-15929 | Craft CMS possibility of brute force attempts | critical | 9.8 | <3.1.7 | 3.1.7 |
| CVE-2018-20465 | Craft CMS Vulnerable to Server-Side Template Injection | high | 7.2 | <=3.0.34 | – |
| CVE-2025-46731 | Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | high | 0.0 | >=4.0.0-RC1 and <4.14.13 or >=5.0.0-RC1 and <5.6.15 | 4.14.13, 5.6.15 |
| CVE-2023-30130 | CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter | high | 8.8 | <=3.8.1 | – |
| CVE-2021-41824 | CSV Injection Vulnerability | high | 8.8 | >=3.4.0 and <3.7.14 | 3.7.14 |
| CVE-2024-52293 | Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI | high | 7.2 | >=4.0.0-RC1 and <4.12.2 or >=5.0.0-RC1 and <5.4.3 | 4.12.2, 5.4.3 |
| CVE-2024-52291 | Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution | high | 8.4 | >=5.0.0-RC1 and <5.4.6 or >=4.0.0-RC1 and <4.12.5 | 5.4.6, 4.12.5 |
| CVE-2017-8383 | Craft CMS Unauthorized View | medium | 5.3 | <2.6.2976 | 2.6.2976 |
| CVE-2026-25498 | Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | >=5.0.0-RC1 and <5.8.22 or >=4.0.0-RC1 and <4.16.18 | 5.8.22, 4.16.18 |
| CVE-2026-33157 | Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | >=5.6.0 and <5.9.13 | 5.9.13 |
| CVE-2026-28697 | Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates | critical | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2022-37783 | Craft CMS discloses password hashes | high | 7.5 | >=3.0.0 and <3.7.33 | 3.7.33 |
| CVE-2023-36260 | Craft CMS Feed-Me | high | 7.5 | <4.6.2 | 4.6.2 |
| CVE-2021-27902 | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | <3.6.0 | 3.6.0 |
| CVE-2025-68455 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | >=5.0.0-RC1 and <5.8.21 or >=4.0.0-RC1 and <4.16.17 | 5.8.21, 4.16.17 |
| CVE-2017-8385 | Craft CMS subject to URL forgery | medium | 5.3 | <2.6.2976 | 2.6.2976 |
| CVE-2019-12823 | Craft CMS XSS Vulnerability | medium | 6.1 | <3.1.31 | 3.1.31 |
| CVE-2025-68454 | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | >=5.0.0-RC1 and <5.8.21 or >=4.0.0-RC1 and <4.16.17 | 5.8.21, 4.16.17 |
| CVE-2025-57811 | Craft CMS Potential Remote Code Execution via Twig SSTI | medium | 0.0 | >=4.0.0-RC1 and <4.16.6 or >=5.0.0-RC1 and <5.8.7 | 4.16.6, 5.8.7 |
| CVE-2026-31857 | CraftCMS has an RCE vulnerability via relational conditionals in the control panel | high | 0.0 | >=5.0.0-RC1 and <5.9.9 or >=4.0.0-beta.1 and <4.17.4 | 5.9.9, 4.17.4 |
| CVE-2020-19626 | Craft CMS Cross-site Scripting Vulnerability | medium | 5.4 | <3.1.33 | 3.1.33 |
| CVE-2017-8384 | Craft CMS XSS Vulnerability | medium | 6.1 | <2.6.2976 | 2.6.2976 |
| CVE-2019-17496 | Craft CMS XSS Vulnerability | medium | 6.1 | <3.3.8 | 3.3.8 |
| CVE-2017-8052 | Craft CMS XSS Vulnerability | medium | 6.1 | <2.6.2974 | 2.6.2974 |
| CVE-2026-72778 | Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass | high | 0.0 | >=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2 | 5.10.6, 4.18.2 |
| CVE-2023-23927 | Craft CMS Stored Cross-site Scripting Injection Vulnerability | medium | 6.1 | >=4.0.0-RC1 and <4.3.7 or >=3.7.24 and <3.7.64 | 4.3.7, 3.7.64 |
| CVE-2026-72781 | Craft CMS: Authenticated RCE through Twig sandbox escape | high | 0.0 | >=5.0.0-RC1 and <5.10.7 or >=4.0.0-RC1 and <4.18.3 | 5.10.7, 4.18.3 |
| CVE-2024-52292 | Craft CMS Arbitrary System File Read | high | 7.7 | >=5.0.0-alpha.1 and <5.4.9 or >=3.5.13 and <4.12.8 | 5.4.9, 4.12.8 |
| CVE-2021-32470 | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | <3.6.13 | 3.6.13 |
| CVE-2023-33197 | Craft CMS stored XSS in indexedVolumes | medium | 5.5 | >=4.0.0-RC1 and <4.4.6 | 4.4.6 |
| CVE-2026-56382 | Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview | high | 0.0 | >=5.5.0 and <5.9.14 | 5.9.14 |
| CVE-2022-37250 | Craft CMS Stored Cross-site Scripting in User Addresses Title | medium | 5.4 | >=4.0.0-RC1 and <4.2.1 | 4.2.1 |
| CVE-2022-37248 | Craft CMS Cross site Scripting vulnerability | medium | 5.4 | >=4.0.0-RC1 and <4.2.1 | 4.2.1 |
| CVE-2023-33196 | Craft CMS stored XSS in review volume | medium | 5.5 | >=4.0.0-RC1 and <4.4.7 | 4.4.7 |
| CVE-2023-33195 | Craft CMS XSS in RSS widget feed | medium | 6.1 | >=4.3.0 and <4.4.6 | 4.4.6 |
| CVE-2022-28378 | Cross-site Scripting in craftcms/cms | medium | 6.1 | <3.7.29 | 3.7.29 |
| CVE-2026-28695 | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | medium | 0.0 | >=5.8.7 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-44011 | Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | >=4.0.0 and <4.17.12 or >=5.0.0 and <5.9.18 | 4.17.12, 5.9.18 |
| CVE-2023-33194 | CraftCMS stored XSS in Quick Post widget error message | low | 3.7 | >=4.0.0-RC1 and <4.4.6 or >=3.0.0 and <3.8.6 | 4.4.6, 3.8.6 |
| CVE-2024-21622 | Craft CMS Privilege Escalation | medium | 5.4 | >=4.0.0-RC1 and <4.5.11 or >=3.0.0 and <3.9.6 | 4.5.11, 3.9.6 |
| CVE-2022-37247 | Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page | medium | 5.4 | >=4.0.0-RC1 and <4.2.1 | 4.2.1 |
| CVE-2026-25495 | Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` | high | 0.0 | >=5.0.0-RC1 and <5.8.22 or >=4.0.0-RC1 and <4.16.18 | 5.8.22, 4.16.18 |
| CVE-2025-68456 | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | >=5.0.0-RC1 and <5.8.21 or >=3.0.0 and <4.16.17 | 5.8.21, 4.16.17 |
| CVE-2026-28784 | Craft CMS has potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-32264 | Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | high | 0.0 | >=4.0.0-RC1 and <4.17.5 or >=5.0.0-RC1 and <5.9.11 | 4.17.5, 5.9.11 |
| CVE-2022-37246 | Craft CMS Cross-site Scripting vulnerability | medium | 5.4 | >=4.0.0-RC1 and <4.2.1 or >=3.7.39 and <3.7.51 | 4.2.1, 3.7.51 |
| CVE-2026-32263 | Craft CMS vulnerable to behavior injection RCE via EntryTypesController | high | 0.0 | >=5.6.0 and <5.9.11 | 5.9.11 |
| CVE-2022-37251 | Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts | medium | 5.4 | >=3.7.0-beta.1 and <3.7.55.2 or >=4.0.0-RC1 and <4.2.1 | 3.7.55.2, 4.2.1 |
| CVE-2025-54417 | Craft CMS has a theoretical bypass for CVE-2025-23209 | medium | 0.0 | >=4.13.8 and <4.16.3 or >=5.5.8 and <5.8.4 | 4.16.3, 5.8.4 |
| CVE-2023-33495 | Craft CMS vulnerable to HTML injection | medium | 6.1 | <=4.4.9 | – |
| CVE-2026-56394 | Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read | low | 0.0 | >=4.0.0-RC1 and <4.17.7 or >=5.0.0-RC1 and <5.9.13 | 4.17.7, 5.9.13 |
| CVE-2026-27127 | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | high | 0.0 | >=5.0.0-RC1 and <5.8.23 or >=3.5.0 and <4.16.19 | 5.8.23, 4.16.19 |
| CVE-2026-28783 | Craft CMS has Twig Function Blocklist Bypass | medium | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-25497 | Craft CMS: GraphQL Asset Mutation Privilege Escalation | high | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2025-68437 | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | medium | 0.0 | >=5.0.0-RC1 and <5.8.21 or >=3.5.0 and <4.16.17 | 5.8.21, 4.16.17 |
| CVE-2026-28696 | Craft CMS has IDOR via GraphQL @parseRefs | high | 0.0 | >=4.0.0-RC1 and <4.17.0-beta.1 or >=5.0.0-RC1 and <5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| CVE-2026-27129 | Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | medium | 0.0 | >=5.0.0-RC1 and <5.8.23 or >=3.5.0 and <4.16.19 | 5.8.23, 4.16.19 |
| CVE-2026-55791 | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | critical | 0.0 | >=5.0.0-RC1 and <5.10 or >=4.0.0-RC1 and <4.18 | 5.10, 4.18 |
| CVE-2026-72786 | Craft CMS: Arbitrary user password reset leading to administrator account takeover | high | 0.0 | >=5.0.0-RC1 and <5.10.8 | 5.10.8 |
| CVE-2026-55790 | Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | high | 0.0 | >=5.0.0-RC1 and <5.9.23 or >=4.0.0-RC1 and <4.17.16 | 5.9.23, 4.17.16 |
| CVE-2024-41800 | Craft CMS Allows TOTP Token To Stay Valid After Use | medium | 4.8 | >=5.0.0-beta.1 and <5.2.3 | 5.2.3 |
| CVE-2023-2817 | Stored cross site scripting in Craft CMS | medium | 5.4 | >=4.0.0-RC1 and <4.4.12 | 4.4.12 |
| CVE-2026-50281 | Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | high | 0.0 | >=5.7.0 and <5.9.21 | 5.9.21 |
| CVE-2026-25496 | Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields | medium | 0.0 | >=5.0.0-RC1 and <5.8.22 or >=4.0.0-RC1 and <4.16.18 | 5.8.22, 4.16.18 |
| CVE-2026-44010 | Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | high | 0.0 | >=5.0.0 and <5.9.18 or >=4.0.0 and <4.17.12 | 5.9.18, 4.17.12 |
| CVE-2026-55794 | Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | high | 0.0 | >=5.9.0 and <5.10.0 | 5.10.0 |
| CVE-2023-31144 | craftcms/cms vulnerable to cross site scripting in RSS feed widget | medium | 6.1 | >=3.0.0 and <3.8.4 or >=4.0.0 and <4.4.4 | 3.8.4, 4.4.4 |
| CVE-2026-25493 | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect | medium | 0.0 | >=5.0.0-RC1 and <5.8.22 or >=4.0.0-RC1 and <4.16.18 | 5.8.22, 4.16.18 |
| CVE-2026-25494 | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation | medium | 0.0 | >=5.0.0-RC1 and <5.8.22 or >=4.0.0-RC1 and <4.16.18 | 5.8.22, 4.16.18 |
| CVE-2026-50280 | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check | medium | 0.0 | >=5.0.0-RC1 and <5.9.21 | 5.9.21 |
| CVE-2023-30177 | Cross Site Scripting in CraftCMS | medium | 6.1 | <3.7.68 | 3.7.68 |
| CVE-2026-50284 | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | high | 0.0 | >=5.0.0-RC1 and <5.9.22 or >=4.0.0-RC1 and <4.17.15 | 5.9.22, 4.17.15 |
| CVE-2026-14793 | Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets | medium | 4.3 | >=4.0.0-RC1 and <4.18.1 or >=5.0.0-RC1 and <5.10.3 | 4.18.1, 5.10.3 |
| CVE-2026-72782 | Craft CMS: Authenticated leak of secret environment variables | medium | 0.0 | >=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2 | 5.10.6, 4.18.2 |
| CVE-2026-14794 | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | medium | 4.3 | >=4.0.0-RC1 and <4.18.1 or >=5.0.0-RC1 and <5.10.3 | 4.18.1, 5.10.3 |
| CVE-2026-72780 | Craft CMS: Passkey login accepts replayed WebAuthn assertions | critical | 0.0 | >=5.0.0-RC1 and <5.10.5 | 5.10.5 |
| CVE-2026-72779 | Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts | medium | 0.0 | >=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2 | 5.10.6, 4.18.2 |
| CVE-2026-31858 | CraftCMS's `ElementSearchController` Affected by Blind SQL Injection | high | 0.0 | >=5.0.0-RC1 and <5.9.9 | 5.9.9 |
| CVE-2026-50279 | Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap | high | 0.0 | >=5.0.0-RC1 and <5.9.21 | 5.9.21 |
| CVE-2026-50283 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | medium | 0.0 | >=5.0.0-RC1 and <5.9.21 or >=4.0.0-RC1 and <4.17.14 | 5.9.21, 4.17.14 |
| CVE-2026-33160 | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | low | 0.0 | >=5.0.0-RC1 and <5.9.14 or >=4.0.0-RC1 and <4.17.8 | 5.9.14, 4.17.8 |
| CVE-2026-33158 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | medium | 0.0 | >=4.0.0-RC1 and <4.17.8 or >=5.0.0-RC1 and <5.9.14 | 4.17.8, 5.9.14 |
| CVE-2026-56385 | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | >=5.0.0-RC1 and <5.9.14 or >=4.0.0-RC1 and <4.17.8 | 5.9.14, 4.17.8 |
| CVE-2026-25491 | Craft CMS Vulnerable to Stored XSS in Entry Types Name | low | 0.0 | >=5.0.0-RC1 and <5.8.22 | 5.8.22 |
| CVE-2024-45406 | Craft CMS vulnerable to stored XSS in breadcrumb list and title fields | medium | 5.5 | >=5.0.0 and <5.1.2 | 5.1.2 |
| CVE-2026-50282 | Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves | high | 0.0 | >=5.0.0-RC1 and <5.9.21 or >=4.0.0-RC1 and <4.17.14 | 5.9.21, 4.17.14 |
| CVE-2026-28781 | Craft CMS: Entries Authorship Spoofing via Mass Assignment | medium | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-44012 | Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | high | 0.0 | >=5.0.0-RC1 and <5.9.18 | 5.9.18 |
| CVE-2026-55792 | Craft CMS: Sensitive File Disclosure / Server-Side File Read | medium | 0.0 | >=4.0.0-RC1 and <4.18.0 or >=5.0.0-RC1 and <5.10.0 | 4.18.0, 5.10.0 |
| CVE-2026-56384 | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | >=4.0.0-RC1 and <4.17.8 or >=5.0.0-RC1 and <5.9.14 | 4.17.8, 5.9.14 |
| CVE-2026-41130 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | medium | 0.0 | >=5.0.0-RC1 and <5.9.15 or >=4.0.0-RC1 and <4.17.9 | 5.9.15, 4.17.9 |
| CVE-2026-55793 | Craft CMS: Stored XSS via Structure entry title in table view | medium | 0.0 | >=5.0.0-RC1 and <5.9.53 | 5.9.53 |
| CVE-2026-33159 | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | medium | 0.0 | >=5.0.0-RC1 and <5.9.14 or >=4.0.0-RC1 and <4.17.8 | 5.9.14, 4.17.8 |
| CVE-2026-32262 | Craft CMS has a Path Traversal Vulnerability in AssetsController | medium | 0.0 | >=4.0.0-RC1 and <4.17.5 or >=5.0.0-RC1 and <5.9.11 | 4.17.5, 5.9.11 |
| CVE-2026-33162 | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | medium | 0.0 | >=5.3.0 and <5.9.14 | 5.9.14 |
| CVE-2026-29069 | Craft CMS has unauthenticated activation email trigger with potential user enumeration | high | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.2 or >=4.0.0-RC1 and <4.17.0-beta.2 | 5.9.0-beta.2, 4.17.0-beta.2 |
| CVE-2025-68436 | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | medium | 0.0 | >=5.0.0-RC1 and <5.8.21 or >=4.0.0-RC1 and <4.16.17 | 5.8.21, 4.16.17 |
| CVE-2026-41129 | Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations | medium | 0.0 | >=5.0.0-RC1 and <5.9.15 or >=4.0.0-RC1 and <4.17.9 | 5.9.15, 4.17.9 |
| CVE-2026-72785 | Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | medium | 0.0 | >=5.0.0-RC1 and <5.10.6 | 5.10.6 |
| CVE-2026-72787 | Craft CMS: Stored XSS in the control panel via unescaped draft name | medium | 0.0 | >=5.0.0-RC1 and <5.10.8 | 5.10.8 |
| CVE-2026-33051 | Craft CMS Vulnerable to Stored XSS in Revision Context Menu | medium | 0.0 | >=5.9.0-beta.1 and <5.9.11 | 5.9.11 |
| CVE-2026-28782 | Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action | medium | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-41128 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | medium | 0.0 | >=5.6.0 and <5.9.15 | 5.9.15 |
| CVE-2026-27126 | Craft CMS has Stored XSS in Table Field via "HTML" Column Type | medium | 0.0 | >=4.5.0-RC1 and <4.16.19 or >=5.0.0-RC1 and <5.8.23 | 4.16.19, 5.8.23 |
| CVE-2026-56393 | Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options | low | 0.0 | >=5.0.0-RC1 and <5.9.0-beta.1 or >=4.0.0-RC1 and <4.17.0-beta.1 | 5.9.0-beta.1, 4.17.0-beta.1 |
| CVE-2026-33161 | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | >=5.0.0-RC1 and <5.9.14 or >=4.0.0-RC1 and <4.17.8 | 5.9.14, 4.17.8 |
| CVE-2026-56383 | Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type | low | 0.0 | >=4.5.0-beta.1 and <4.16.19 or >=5.0.0-RC1 and <5.8.23 | 4.16.19, 5.8.23 |
| CVE-2026-72783 | Craft CMS: Incorrect path validation could potentially lead to path traversal | low | 0.0 | >=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2 | 5.10.6, 4.18.2 |
| CVE-2026-27128 | Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit | medium | 0.0 | >=4.5.0-RC1 and <4.16.19 or >=5.0.0-RC1 and <5.8.23 | 4.16.19, 5.8.23 |
| CVE-2026-31859 | CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization | medium | 0.0 | >=4.15.3 and <4.17.3 or >=5.7.5 and <5.9.7 | 4.17.3, 5.9.7 |
| CVE-2026-29113 | Craft CMS has a potential information disclosure vulnerability in preview tokens | low | 0.0 | >=4.0.0-RC1 and <4.17.3 or >=5.0.0-RC1 and <5.9.7 | 4.17.3, 5.9.7 |
| CVE-2026-56381 | Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page | low | 0.0 | >=5.0.0-RC1 and <5.8.22 | 5.8.22 |
| GHSA-wf98-vxv9-jqfv | XSS Injection Vulnerability | low | 0.0 | <3.7.29 | 3.7.29 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked