statamic/cms vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-25759Highstatamic/cms: Statamic CMS vulnerable to privilege escalation via stored cross-site scripting CVE-2026-25633Mediumstatamic/cms: Statamic CMS's missing authorization allows access to assets CVE-2025-64112Highstatamic/cms: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation CVE-2024-52600Mediumstatamic/cms: Statamic CMS has a Path Traversal in Asset Upload CVE-2024-36119Lowstatamic/cms: Password confirmation stored in plain text via registration form in statamic/cms CVE-2024-24570Highstatamic/cms: Statmic CMS vulnerable to account takeover via XSS and password reset link CVE-2023-48701Highstatamic/cms: Cross-site Scripting via uploaded assets CVE-2023-48217Highstatamic/cms: Statamic CMS vulnerable to remote code execution via form uploads CVE-2023-47129Highstatamic/cms: Statamic CMS remote code execution via front-end form uploads CVE-2023-36828Mediumstatamic/cms: Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG CVE-2017-11422Highstatamic/cms: Statamic framework Incorrect Permission Assignment CVE-2022-24784Lowstatamic/cms: Discoverability of user password hash in Statamic CMS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo