CVE-2026-33162

>= 5.3.0 and < 5.9.14

Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user w

6.5MEDIUM

CVE-2026-33161

> 4.0.0 and < 4.17.8

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to befo

4.3MEDIUM

CVE-2026-33160

> 4.0.0 and < 4.17.8

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to befo

5.3MEDIUM

CVE-2026-33159

> 4.0.0 and < 4.17.8

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to befo

6.5MEDIUM

CVE-2026-33158

> 4.0.0 and < 4.17.8

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to befo

6.5MEDIUM

CVE-2026-33157

>= 5.6.0 and < 5.9.13

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnera

7.2HIGH

CVE-2026-33051

>= 5.9.0 and < 5.9.11

Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the el

5.4MEDIUM

CVE-2026-32267

>= 4.0.0.1 and < 4.17.6

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to befo

9.8CRITICAL

CVE-2026-32264

>= 4.0.0.1 and < 4.17.5

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to befo

7.2HIGH

CVE-2026-32263

>= 5.6.0 and < 5.9.11

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesControll

7.2HIGH

CVE-2026-32262

>= 4.0.0.1 and < 4.17.5

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to befo

4.3MEDIUM

CVE-2026-31867

>= 4.0.0 and < 4.11.0

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulne

4.8MEDIUM

CVE-2026-31859

>= 4.15.3 and < 4.17.3

Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/U

6.1MEDIUM

CVE-2026-31858

>= 5.0.1 and < 5.9.9

Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection

8.8HIGH

CVE-2026-31857

>= 4.0.0.1 and < 4.17.4

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft C

8.8HIGH

CVE-2026-29177

>= 4.0.0 and < 4.10.2

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerabilit

5.4MEDIUM

CVE-2026-29176

>= 5.0.0 and < 5.5.3

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings

4.8MEDIUM

CVE-2026-29175

>= 5.0.0 and < 5.5.3

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory

5.4MEDIUM

CVE-2026-29174

>= 5.0.0 and < 5.5.3

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the invent

8.8HIGH

CVE-2026-29173

>= 4.0.0 and < 4.10.2

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tr

4.8MEDIUM

CVE-2026-29172

>= 4.0.0 and < 4.10.2

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in

8.8HIGH

CVE-2026-29113

>= 4.0.0 and < 4.17.4

Craft is a content management system (CMS). Prior to 4.17.4 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at

4.3MEDIUM

CVE-2026-29069

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is a

5.3MEDIUM

CVE-2026-28784

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twi

7.2HIGH

CVE-2026-28783

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent p

9.1CRITICAL

CVE-2026-28782

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properl

4.3MEDIUM

CVE-2026-28781

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass As

6.5MEDIUM

CVE-2026-28697

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Re

9.1CRITICAL

CVE-2026-28696

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to

7.5HIGH

CVE-2026-28695

> 4.0.0 and < 4.17.0

Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injec

7.2HIGH

CVE-2026-27129

>= 3.5.0 and < 4.16.19

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validatio

6.5MEDIUM

CVE-2026-27128

> 4.5.0 and < 4.16.19

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Ti

4.8MEDIUM

CVE-2026-27127

>= 3.5.1 and < 4.16.19

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validatio

6.3MEDIUM

CVE-2026-27126

> 4.5.0 and < 4.16.19

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-sit

4.8MEDIUM

CVE-2026-25498

> 4.0.0 and < 4.16.18

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote

7.2HIGH

CVE-2026-25497

> 4.0.0 and < 4.17.0

Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, t

8.8HIGH

CVE-2026-25496

> 4.0.0 and < 4.16.18

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a

4.8MEDIUM

CVE-2026-25495

> 4.0.0 and < 4.16.18

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, th

8.8HIGH

CVE-2026-25494

> 4.0.0 and < 4.16.18

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, t

6.5MEDIUM

CVE-2026-25493

> 4.0.0 and < 4.16.18

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, th

6.5MEDIUM

CVE-2026-25492

>= 3.5.0 and < 4.16.18

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_As

6.5MEDIUM

CVE-2026-25491

>= 5.0.0 and < 5.8.21

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The n

4.8MEDIUM

CVE-2026-25522

>= 4.0.0 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25490

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25489

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25488

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25487

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25486

>= 5.0.0 and < 5.5.2

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce a

4.8MEDIUM

CVE-2026-25485

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

4.8MEDIUM

CVE-2026-25484

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a St

4.8MEDIUM

CVE-2026-25483

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS

5.4MEDIUM

CVE-2026-25482

>= 4.0.1 and < 4.10.1

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM

4.8MEDIUM

CVE-2025-68456

>= 3.0.0 and < 4.16.17

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthentic

9.1CRITICAL

CVE-2025-68455

>= 4.0.0.1 and < 4.16.17

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerab

7.2HIGH

CVE-2025-68454

>= 4.0.0.1 and < 4.16.17

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerab

8.8HIGH

CVE-2025-68437

>= 3.5.0 and < 4.16.17

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craf

6.8MEDIUM

CVE-2025-68436

>= 4.0.0.1 and < 4.16.17

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenti

6.5MEDIUM

CVE-2025-57811

>= 4.1.0 and < 4.16.6

Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potenti

7.2HIGH

CVE-2025-54417

>= 4.13.8 and < 4.16.3

Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerabili

8.8HIGH

CVE-2025-35939

< 4.15.3

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed

5.3MEDIUM

CVE-2025-46731

>= 4.1.0 and < 4.14.13

Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.

7.2HIGH

CVE-2025-32432

>= 3.0.0 and < 3.9.15

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-

10.0CRITICAL

CVE-2025-23209

> 4.0.0 and < 4.13.8

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execu

8.0HIGH

CVE-2024-56145

>= 3.0.0 and < 3.9.14

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions a

9.8CRITICAL

CVE-2024-52292

>= 3.5.13 and < 4.12.8

Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system n

7.7HIGH

CVE-2024-52291

> 4.0.0 and < 4.12.5

Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation

8.4HIGH

CVE-2024-52293

> 4.0.0 and < 4.12.2

Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::

7.2HIGH

CVE-2024-45406

>= 5.0.0 and < 5.1.2

Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with u

5.5MEDIUM

CVE-2024-41800

>= 5.0.1 and < 5.2.3

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An

4.8MEDIUM

CVE-2024-37843

< 3.7.31

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

9.8CRITICAL

CVE-2023-36260

< 4.6.1.1

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) v

7.5HIGH

CVE-2023-36259

< 3.0.2

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code

5.4MEDIUM

CVE-2024-21622

>= 3.0.0 and < 3.9.6

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Cr

5.4MEDIUM

CVE-2023-41892

>= 4.4.0 and < 4.4.15

Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft

10.0CRITICAL

CVE-2023-40035

>= 3.0.0 and < 3.8.15

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to pote

7.2HIGH

CVE-2023-33495

<= 4.4.9

Craft CMS through 4.4.9 is vulnerable to HTML Injection.

6.1MEDIUM

CVE-2023-30179

all versions

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template

7.2HIGH

CVE-2023-33195

>= 4.3.0 and < 4.4.6

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was

5.0MEDIUM

CVE-2023-33196

>= 4.0.1 and < 4.4.7

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue

5.5MEDIUM

CVE-2023-33194

>= 3.0.0 and < 3.8.6

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Po

3.7LOW

CVE-2023-33197

< 4.4.6

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asse

5.5MEDIUM

CVE-2023-2817

<= 4.4.11

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tag

5.4MEDIUM

CVE-2023-32679

>= 4.0.0 and < 4.4.6

Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead t

7.2HIGH

CVE-2023-30130

all versions

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section paramete

8.8HIGH

CVE-2023-31144

>= 3.0.0 and <= 3.8.3

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in th

6.1MEDIUM

CVE-2023-30177

all versions

CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

6.1MEDIUM

CVE-2023-23927

< 4.3.7

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry typ

6.1MEDIUM

CVE-2022-37783

>= 3.0.0 and <= 3.7.32

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or u

7.5HIGH

CVE-2022-37246

all versions

Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in

5.4MEDIUM

CVE-2022-37251

all versions

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

5.4MEDIUM

CVE-2022-37247

all versions

Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

5.4MEDIUM

CVE-2022-37248

all versions

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.

5.4MEDIUM

CVE-2022-37250

all versions

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.

5.4MEDIUM

CVE-2022-29933

<= 3.7.36

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's p

8.8HIGH

CVE-2022-28378

< 3.7.29

Craft CMS before 3.7.29 allows XSS.

6.1MEDIUM

CVE-2021-41824

>= 3.4.0 and < 3.7.14

Craft CMS before 3.7.14 allows CSV injection.

8.8HIGH

CVE-2021-27903

< 3.6.7

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed

9.8CRITICAL

CVE-2021-27902

< 3.6.0

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with

6.1MEDIUM

CVE-2021-32470

< 3.6.13

Craft CMS before 3.6.13 has an XSS vulnerability.

6.1MEDIUM

CVE-2020-19626

all versions

Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /

5.4MEDIUM

CVE-2020-9757

< 3.3.0

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to th

9.8CRITICAL

CVE-2019-9554

all versions

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admi

6.1MEDIUM

CVE-2019-15929

<= 3.1.7

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to th

9.8CRITICAL

CVE-2019-17496

< 3.3.8

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.

6.1MEDIUM

CVE-2019-14280

>= 2.0.2524 and < 2.7.10

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was c

5.3MEDIUM

CVE-2019-12823

< 3.1.31

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.

6.1MEDIUM

CVE-2018-20465

<= 3.0.34

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injecti

7.2HIGH

CVE-2018-20418

all versions

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

4.8MEDIUM

CVE-2018-3814

all versions

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "R

8.8HIGH

CVE-2017-9516

<= 2.6.2981

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

5.4MEDIUM

CVE-2017-8385

<= 2.6.2974

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

5.3MEDIUM

CVE-2017-8384

<= 2.6.2974

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments(

6.1MEDIUM

CVE-2017-8383

<= 2.6.2974

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.

5.3MEDIUM

CVE-2017-8052

<= 2.6.2973

Craft CMS before 2.6.2974 allows XSS attacks.

6.1MEDIUM