Product by CraftCMS

    CMS

    138 known vulnerabilities in CMS (CraftCMS), 4 of them actively exploited (CISA KEV).

    Key figures

    138

    Vulnerabilities

    4

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in CMS (CraftCMS)
    CriticalCVE-2025-32432

    Craft CMS Allows Remote Code Execution

    In CISA KEValso in 1 other product

    		10.0
    CriticalCVE-2024-56145

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2025-23209

    Potential RCE with a compromised security key in craft/cms

    In CISA KEValso in 1 other product

    		8.1
    CriticalCVE-2025-35939

    Craft CMS stores user-provided content in session files

    In CISA KEValso in 2 other products

    		5.3
    CriticalCVE-2026-32267

    CraftCMS CMS: Incorrect Authorization

    also in 1 other product

    		9.8
    CriticalCVE-2023-41892

    Craft CMS Remote Code Execution vulnerability

    also in 1 other product

    		10.0
    HighCVE-2026-78416

    Authenticated RCE via `condition.config` JSON cleanse bypass

    		—
    CriticalCVE-2026-28697

    Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

    also in 1 other product

    		9.1
    HighCVE-2026-112770

    Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

    		8.8
    HighCVE-2026-112773

    Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

    		8.8
    HighCVE-2026-112772

    Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

    		8.8
    HighCVE-2026-86732

    Craft CMS before 5.10.12 Remote Code Execution via element-index

    		8.8
    HighCVE-2026-105985

    Authenticated RCE via render-components Entry Type overrides

    		8.8
    HighCVE-2023-40035

    Craft CMS vulnerable to Remote Code Execution via validatePath bypass

    also in 1 other product

    		7.2
    HighCVE-2026-112774

    Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

    		7.2
    HighCVE-2026-33157

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    also in 1 other product

    		7.2
    HighCVE-2026-112777

    Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

    		7.2
    HighCVE-2026-72778

    Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

    		8.8
    HighCVE-2026-86730

    Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

    		8.8
    HighCVE-2026-25498

    Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

    also in 1 other product

    		7.2
    HighCVE-2026-72781

    Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

    		8.8
    HighCVE-2026-92592

    Craft CMS before 4.18.6 Remote Code Execution via signed cookie

    		8.8
    HighCVE-2026-79987

    Low-privilege RCE through element-search eager loading

    		8.8
    HighCVE-2025-46731

    Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

    also in 1 other product

    		7.2
    CriticalCVE-2026-84795

    Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

    		9.8

    All vulnerabilities in search

    All products by CraftCMS