Vendor

    Sitecore

    40 known vulnerabilities in products by Sitecore, 4 of them actively exploited (CISA KEV).

    Key figures

    40

    Vulnerabilities

    4

    Actively exploited (KEV)

    1

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Sitecore
    CriticalCVE-2021-42237

    Sitecore XP Remote Command Execution Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2025-53690

    Sitecore Products ViewState Deserialization Vulnerability

    In CISA KEV

    		9.0
    CriticalCVE-2019-9874

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    In CISA KEV

    		9.8
    CriticalCVE-2019-9875

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    In CISA KEV

    		8.8
    CriticalCVE-2025-53693

    HTML Cache Poisoning through Unsafe Reflections

    		9.8
    CriticalCVE-2023-35813

    Sitecore Experience Commerce: Remote Code Execution

    		9.8
    HighCVE-2025-34511

    Sitecore PowerShell Extension RCE via Unrestricted Upload

    		8.8
    HighCVE-2025-34510

    Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

    		8.8
    HighCVE-2025-34509

    Sitecore XM and XP Hardcoded Credentials

    		7.5
    HighCVE-2024-46938

    Sitecore Experience Commerce: security vulnerability

    		7.5
    HighCVE-2025-53694

    Information Disclosure in ItemServices API

    		7.5
    HighCVE-2019-11080

    Sitecore Experience Platform: Deserialization of Untrusted Data

    		8.8
    HighCVE-2018-7669

    Sitecore.NET: Path Traversal

    		7.5
    HighCVE-2021-38366

    Sitecore: Remote Code Execution

    		8.8
    HighCVE-2023-33652

    Sitecore Experience Platform: Remote Code Execution

    		8.8
    CriticalCVE-2019-12440

    Sitecore Rocks: security vulnerability

    		9.8
    HighCVE-2025-53691

    Sitecore Experience Remote Code Execution through Insecure Deserialization

    		8.8
    CriticalCVE-2023-27068

    Sitecore Experience Platform: Deserialization of Untrusted Data

    		9.8
    HighCVE-2023-33653

    Sitecore Experience Platform: Remote Code Execution

    		8.8
    HighCVE-2023-27067

    Sitecore Experience Platform: Path Traversal

    		7.5
    HighCVE-2023-26262

    Sitecore Experience Manager: Code Execution

    		7.2
    MediumCVE-2016-8855

    Sitecore Experience Platform: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-33651

    Sitecore Experience Commerce: security vulnerability

    		7.5
    MediumCVE-2023-27066

    Sitecore Experience Platform: Path Traversal

    		6.5
    MediumCVE-2017-11440

    Sitecore CMS and Experience Platform (XP): Path Traversal

    		4.9

    All vulnerabilities in search

    Products

    Products by Sitecore
    Sitecore Experience Platform243
    Sitecore Experience Manager131
    Sitecore Experience Commerce111
    Sitecore Managed Cloud101
    Sitecore CMS and Experience Platform (XP)82
    Experience Platform (xp)71
    Experience Manager (xm)31
    Sitecore Experience Manager (xm)30