S
Vendor security profile
statamic
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical0
CISA KEV0
Public exploit0
Patch rate%86
Avg. CVSS6.1
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
7
0
0
CVE KEV
CVE severity distribution
7toplam CVE
High1 (14%)
Medium6 (86%)
Patch and exploitation view
%86
Verified patch
%0
CISA KEV
%0
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
6.1
CVE-2026-71435
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
S
Patch verifiedEPSS %0
5.3
CVE-2026-71434
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
S
Patch verifiedEPSS %0
6.5
CVE-2026-64662
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
S
Patch verifiedEPSS %0
6.5
CVE-2026-64663
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
S
Patch verifiedEPSS %0
8.1
CVE-2026-64665
Statamic: Account takeover via OAuth email matching without email-verification check
S
Patch verifiedEPSS %1
4.3
CVE-2026-64664
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
S
Patch verifiedEPSS %0
6.2
CVE-2026-71293
Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
S
Patch status unknownEPSS %0