craftcms/cms vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-27126Mediumcraftcms/cms: Craft CMS has Stored XSS in Table Field via "HTML" Column Type CVE-2026-25498Highcraftcms/cms: Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25497Highcraftcms/cms: Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25496Mediumcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields CVE-2026-25495Highcraftcms/cms: Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`CVE-2026-25494Mediumcraftcms/cms: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation CVE-2026-25493Mediumcraftcms/cms: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect CVE-2026-25491Lowcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Entry Types Name CVE-2025-68455Highcraftcms/cms: Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2025-68456Highcraftcms/cms: Unauthenticated Craft CMS users can trigger a database backup CVE-2025-68454Mediumcraftcms/cms: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI CVE-2025-68437Mediumcraftcms/cms: Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation CVE-2025-68436Mediumcraftcms/cms: Craft CMS vulnerable to potential information disclosure via unchecked asset relocation CVE-2025-57811Mediumcraftcms/cms: Craft CMS Potential Remote Code Execution via Twig SSTI CVE-2025-54417Mediumcraftcms/cms: Craft CMS has a theoretical bypass for CVE-2025-23209 CVE-2025-35939Mediumcraftcms/cms: Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-46731Highcraftcms/cms: Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI CVE-2025-32432Criticalcraftcms/cms: Craft CMS Allows Remote Code Execution CVE-2025-23209Highcraftcms/cms: Craft CMS has a potential RCE with a compromised security key CVE-2024-56145Criticalcraftcms/cms: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-52293Highcraftcms/cms: Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI CVE-2024-52292Highcraftcms/cms: Craft CMS Arbitrary System File Read CVE-2024-52291Highcraftcms/cms: Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution CVE-2024-45406Mediumcraftcms/cms: Craft CMS vulnerable to stored XSS in breadcrumb list and title fields CVE-2024-41800Mediumcraftcms/cms: Craft CMS Allows TOTP Token To Stay Valid After Use

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo