statamic/cms vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54244Lowstatamic/cms: Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors CVE-2026-54243Mediumstatamic/cms: Statamic Vulnerable to CSV formula injection in form submission exports CVE-2026-54242Mediumstatamic/cms: Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)CVE-2026-49287Highstatamic/cms: Statamic CMS's unsafe method invocation via collection sorting allows data destruction CVE-2026-49288Mediumstatamic/cms: Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources CVE-2026-45660Mediumstatamic/cms: Statamic CMS: Server-Side Request Forgery via Glide CVE-2026-44306Mediumstatamic/cms: Statamic CMS vulnerable to email enumeration via forgot password endpoint CVE-2026-41175Highstatamic/cms: Statamic: Unsafe method invocation via query value resolution allows data destruction CVE-2026-33887Mediumstatamic/cms: Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33886Mediumstatamic/cms: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields CVE-2026-33885Mediumstatamic/cms: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential CVE-2026-33884Mediumstatamic/cms: Statamic's live preview token bypasses content protection for unrelated entries CVE-2026-33883Mediumstatamic/cms: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag CVE-2026-33882Mediumstatamic/cms: Statamic's Markdown preview endpoint exposes sensitive user data CVE-2026-33177Mediumstatamic/cms: Statamic is missing authorization check on taxonomy term creation via fieldtype CVE-2026-33171Mediumstatamic/cms: Statamic has a path traversal in file dictionary fieldtype CVE-2026-33172Highstatamic/cms: Statamic has Stored XSS via SVG Sanitization Bypass CVE-2026-32612Mediumstatamic/cms: Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-28426Highstatamic/cms: Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-28425Highstatamic/cms: Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs CVE-2026-28424Mediumstatamic/cms: Statamic's missing authorization allows access to email addresses CVE-2026-28423Mediumstatamic/cms: Statamic Vulnerable to Server-Side Request Forgery via Glide CVE-2026-27939Highstatamic/cms: Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass CVE-2026-27593Criticalstatamic/cms: Statamic is vulnerable to account takeover via password reset link injection CVE-2026-27196Highstatamic/cms: Statamic affected by privilege escalation via stored cross-site scripting

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo