C
Vendor security profile1 actively exploited CVEs
craftcms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs47
Critical4
CISA KEV1
Public exploit5
Patch rate%23
Avg. CVSS7.3
12-month vulnerability rate
0
0
5
0
1
0
0
0
0
12
21
6
CVE KEV
CVE severity distribution
47toplam CVE
Critical4 (9%)
High25 (53%)
Medium17 (36%)
Low1 (2%)
Patch and exploitation view
%23
Verified patch
%2
CISA KEV
%11
Public exploit
11Patch available
0Partial
0Workaround
0Vendor: no patch
36Unknown
Latest vulnerabilities
8.7
CVE-2026-109308
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
C
Patch status unknownEPSS %0
2.1
CVE-2026-109307
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
C
Patch status unknownEPSS %0
6.0
CVE-2026-109306
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
C
Patch status unknownEPSS %0
8.7
CVE-2026-109305
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
C
Patch status unknownEPSS %0
6.9
CVE-2026-109304
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
C
Patch status unknownEPSS %0
8.7
CVE-2026-105985
Authenticated RCE via render-components Entry Type overrides
C
Patch verifiedEPSS %1
8.7
CVE-2026-92594
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
C
Patch status unknownEPSS %0
8.7
CVE-2026-92593
Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
C
Patch status unknownEPSS %1
8.7
CVE-2026-92592
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
C
Patch status unknownEPSS %1
8.2
CVE-2026-92591
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
C
Patch status unknownEPSS %0