TI-2026-25592 CVE-2026-33162 · GHSA-f582-6gf6-gx4g
Improper authorization in Craft CMS cms
Priority LOW 28
Craft CMS is a content management system (CMS).
Vulnerabilities
97 records
TI-2026-25591 CVE-2026-33161 · GHSA-vgjg-248p-rfm2
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Priority LOW 7
Craft CMS is a content management system (CMS).
TI-2026-25590 CVE-2026-33160 · GHSA-5pgf-h923-m958
Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
Priority LOW 20
Craft CMS is a content management system (CMS).
TI-2026-25589 CVE-2026-33159 · GHSA-6mrr-q3pj-h53w
Missing authentication in Craft CMS cms
Priority HIGH 70
Craft CMS is a content management system (CMS).
TI-2026-25588 CVE-2026-33158 · GHSA-3pvf-vxrv-hh9c
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Priority LOW 22
Craft CMS is a content management system (CMS).
TI-2026-25587 CVE-2026-33157 · GHSA-2fph-6v5w-89hh
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Priority MEDIUM 41
Craft CMS is a content management system (CMS).
TI-2026-25494 CVE-2026-33051 · GHSA-3x4w-mxpf-fhqq
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Priority LOW 24
Craft CMS is a content management system (CMS).
TI-2026-24796 CVE-2026-32267 · GHSA-cc7p-2j3x-x7xf
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Priority HIGH 69
Craft CMS is a content management system (CMS).
TI-2026-24793 CVE-2026-32264 · GHSA-4484-8v2f-5748
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Priority MEDIUM 40
Craft CMS is a content management system (CMS).
TI-2026-24792 CVE-2026-32263 · GHSA-qx2q-q59v-wf3j
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Priority MEDIUM 40
Craft CMS is a content management system (CMS).
TI-2026-24791 CVE-2026-32262 · GHSA-472v-j2g4-g9h2
Craft CMS has a Path Traversal Vulnerability in AssetsController
Priority LOW 24
Craft CMS is a content management system (CMS).
TI-2026-24411 CVE-2026-31859 · GHSA-fvwq-45qv-xvhv
Craft has Reflective XSS via incomplete return URL sanitization
Priority LOW 36
Craft is a content management system (CMS).
TI-2026-24410 CVE-2026-31858 · GHSA-g7j6-fmwx-7vp8
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
Priority MEDIUM 46
Craft is a content management system (CMS).
TI-2026-24409 CVE-2026-31857 · GHSA-fp5j-j7j4-mcxc
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
Priority MEDIUM 45
Craft is a content management system (CMS).
TI-2026-23254 CVE-2026-29113 · GHSA-vg3j-hpm9-8v5v
Craft has a potential information disclosure vulnerability in preview tokens
Priority LOW 11
Craft is a content management system (CMS).
TI-2026-23214 CVE-2026-29069 · GHSA-234q-vvw3-mrfq
Craft has an unauthenticated activation email trigger with potential user enumeration
Priority LOW 36
Craft is a content management system (CMS).
TI-2026-22979 CVE-2026-28784 · GHSA-qc86-q28f-ggww
Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
Priority MEDIUM 40
Craft is a content management system (CMS).
TI-2026-22978 CVE-2026-28783 · GHSA-5fvc-7894-ghp4
Craft has a Twig Function Blocklist Bypass
Priority MEDIUM 43
Craft is a content management system (CMS).
TI-2026-22977 CVE-2026-28782 · GHSA-jxm3-pmm2-9gf6
Craft has a Permission Bypass and IDOR in Duplicate Entry Action
Priority MEDIUM 57
Craft is a content management system (CMS).
TI-2026-22976 CVE-2026-28781 · GHSA-2xfc-g69j-x2mp
Craft Affected by Entries Authorship Spoofing via Mass Assignment
Priority MEDIUM 64
Craft is a content management system (CMS).
TI-2026-22911 CVE-2026-28697 · GHSA-v47q-jxvr-p68x
Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Priority HIGH 76
Craft is a content management system (CMS).
TI-2026-22910 CVE-2026-28696 · GHSA-7x43-mpfg-r9wj
Craft affected by IDOR via GraphQL @parseRefs
Priority MEDIUM 44
Craft is a content management system (CMS).
TI-2026-22909 CVE-2026-28695 · GHSA-94rc-cqvm-m4pw
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Priority LOW 36
Craft is a content management system (CMS).
TI-2026-21580 CVE-2026-27129 · GHSA-v2gc-rm6g-wrw9
Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Priority LOW 34
Craft is a content management system (CMS).
TI-2026-21579 CVE-2026-27128 · GHSA-6fx5-5cw5-4897
Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
Priority LOW 30
Craft is a content management system (CMS).