statamic/cms vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-71435Mediumstatamic/cms: Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplateCVE-2026-71434Mediumstatamic/cms: Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesCVE-2026-64662Mediumstatamic/cms: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesCVE-2026-64663Mediumstatamic/cms: Statamic: Unsafe method invocation via Antlers template resolution allows data destructionCVE-2026-64665Highstatamic/cms: Statamic: Account takeover via OAuth email matching without email-verification checkCVE-2026-64664Mediumstatamic/cms: Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-54244Lowstatamic/cms: Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-54243Mediumstatamic/cms: Statamic Vulnerable to CSV formula injection in form submission exportsCVE-2026-54242Mediumstatamic/cms: Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)CVE-2026-49287Highstatamic/cms: Statamic CMS's unsafe method invocation via collection sorting allows data destructionCVE-2026-49288Mediumstatamic/cms: Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-45660Mediumstatamic/cms: Statamic CMS: Server-Side Request Forgery via GlideCVE-2026-44306Mediumstatamic/cms: Statamic CMS vulnerable to email enumeration via forgot password endpointCVE-2026-41175Highstatamic/cms: Statamic: Unsafe method invocation via query value resolution allows data destructionCVE-2026-33887Mediumstatamic/cms: Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33886Mediumstatamic/cms: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsCVE-2026-33885Mediumstatamic/cms: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialCVE-2026-33884Mediumstatamic/cms: Statamic's live preview token bypasses content protection for unrelated entriesCVE-2026-33883Mediumstatamic/cms: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tagCVE-2026-33882Mediumstatamic/cms: Statamic's Markdown preview endpoint exposes sensitive user dataCVE-2026-33177Mediumstatamic/cms: Statamic is missing authorization check on taxonomy term creation via fieldtypeCVE-2026-33171Mediumstatamic/cms: Statamic has a path traversal in file dictionary fieldtypeCVE-2026-33172Highstatamic/cms: Statamic has Stored XSS via SVG Sanitization BypassCVE-2026-32612Mediumstatamic/cms: Statamic vulnerable to privilege escalation via stored cross-site scriptingCVE-2026-28426Highstatamic/cms: Statamic vulnerable to privilege escalation via stored cross-site scripting

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo