Craft CMS
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 66 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 26, 2023 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Control panel only API response emulation replaces "securityKey" and reaches server RCE
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
Monitor Craft CMS in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.