Composer october/system has 25 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-32648 KEV | Account Takeover in Octobercms | high | 8.2 | <1.0.472 or >=1.1.1 and <1.1.5 | 1.0.472, 1.1.5 |
| CVE-2022-21705 | Authenticated remote code execution in October CMS | high | 7.2 | <1.0.474 or >=1.1.0 and <1.1.10 or >=2.0.0 and <2.1.27 | 1.0.474, 1.1.10, 2.1.27 |
| CVE-2021-32650 | october/system arbitrary code execution | high | 8.8 | >=1.1.0 and <1.1.6 or <1.0.473 | 1.1.6, 1.0.473 |
| CVE-2022-24800 | October CMS upload process vulnerable to RCE via Race Condition | high | 8.1 | <1.0.476 or >=1.1.0 and <1.1.12 or >=2.0.0 and <2.2.15 | 1.0.476, 1.1.12, 2.2.15 |
| CVE-2021-32649 | October/System authenticated file write leads to remote code execution | high | 8.8 | >=1.1.0 and <1.1.6 or <1.0.473 | 1.1.6, 1.0.473 |
| CVE-2021-41126 | Deleted Admin Can Sign In to Admin Interface | high | 7.2 | >=2.1.0 and <2.1.12 | 2.1.12 |
| CVE-2022-35944 | October CMS Safe Mode bypass leads to authenticated Remote Code Execution | high | 7.2 | >=2.0.0 and <2.2.34 or >=3.0.0 and <3.0.66 | 2.2.34, 3.0.66 |
| CVE-2021-29487 | October CMS auth bypass and account takeover | high | 7.4 | <1.0.472 or >=1.1.1 and <1.1.5 | 1.0.472, 1.1.5 |
| CVE-2023-44382 | October CMS safe mode bypass using Twig sandbox escape | critical | 9.1 | >=3.0.0 and <3.4.15 | 3.4.15 |
| CVE-2022-23655 | Missing server signature validation in OctoberCMS | medium | 4.8 | >=1.1.0 and <1.1.11 or <1.0.475 | 1.1.11, 1.0.475 |
| CVE-2023-44381 | October CMS safe mode bypass using Page template injection | medium | 4.9 | >=3.0.0 and <3.4.15 | 3.4.15 |
| CVE-2023-44383 | October CMS stored XSS by authenticated backend user with improper configuration | medium | 5.4 | >=3.0.0 and <3.5.2 | 3.5.2 |
| CVE-2024-51991 | October CMS Allows Unprotected SVG Rename in Media Manager | low | 0.0 | <3.7.5 | 3.7.5 |
| CVE-2025-61674 | October CMS Vulnerable to Stored XSS via Editor and Branding Styles | medium | 6.1 | <3.7.13 or >=4.0.0 and <4.0.12 | 3.7.13, 4.0.12 |
| CVE-2025-61676 | October CMS Vulnerable to Stored XSS via Branding Styles | medium | 6.1 | <3.7.13 or >=4.0.0 and <4.0.12 | 3.7.13, 4.0.12 |
| CVE-2026-46696 | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls | low | 3.3 | <3.7.17 or >=4.0.0 and <4.2.23 | 3.7.17, 4.2.23 |
| CVE-2024-24764 | October System module has an Open Redirect for Administrator Accounts | low | 3.5 | >=3.2 and <3.5.15 | 3.5.15 |
| CVE-2024-25637 | October System module has a Reflected XSS via X-October-Request-Handler Header | low | 3.1 | >=3.2 and <3.5.15 | 3.5.15 |
| CVE-2026-24906 | October CMS has Stored XSS in Backend Editor Markup Classes | medium | 5.4 | >=4.0.0 and <4.1.10 or <3.7.14 | 4.1.10, 3.7.14 |
| CVE-2026-26067 | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | <3.7.14 or >=4.0.0 and <4.1.10 | 3.7.14, 4.1.10 |
| CVE-2026-49400 | October CMS: PHP Object Injection via Backend Widget Session Storage | low | 3.3 | <3.7.17 or >=4.0.0 and <4.2.23 | 3.7.17, 4.2.23 |
| CVE-2026-24907 | October CMS has Stored XSS in Event Log Mail Preview | medium | 5.4 | >=4.0.0 and <4.1.10 or <3.7.14 | 4.1.10, 3.7.14 |
| CVE-2026-29179 | October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations | low | 3.3 | >=4.0.0 and <4.1.16 or <3.7.16 | 4.1.16, 3.7.16 |
| CVE-2026-27937 | October CMS: Reflected XSS via DataTable Form Widget | low | 3.1 | <3.7.16 or >=4.0.0 | 3.7.16 |
| GHSA-v73w-r9xg-7cr9 | Use of insecure jQuery version in OctoberCMS | medium | 0.0 | >=1.0.319 and <1.0.466 | 1.0.466 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked