Product by Craft

    Craft CMS

    3 known vulnerabilities in Craft CMS (Craft), 1 of them actively exploited (CISA KEV).

    Key figures

    3

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Craft CMS (Craft)
    CriticalCVE-2025-35939

    Craft CMS stores user-provided content in session files

    In CISA KEValso in 1 other product

    		5.3
    MediumCVE-2026-14793

    Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization

    		4.3
    MediumCVE-2026-14794

    Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

    		4.3

    All products by Craft