Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how craft compares to other vendors in security performance

View Risk Score →

composer/craftcms/cmsCraft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Risk 56
Severity
7.4
First published (updated )
CVE-2026-55790

CraftCMS Craft CMSCraft has an unauthenticated activation email trigger with potential user enumeration

Risk 23
Severity
6.9
EPSS
0.05%
First published (updated )
CVE-2026-29069

CraftCMS Craft CMSCloud Metadata SSRF Protection Bypass via IPv6 Resolution

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2026-27129

CraftCMS Craft CMSCraft has a SQL Injection in Element Indexes via criteria[orderBy]

Risk 56
Severity
8.8
EPSS
0.01%
First published (updated )
CVE-2026-25495

CraftCMS Craft CMSCraft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation

Risk 29
Severity
6.9
EPSS
0.01%
First published (updated )
CVE-2026-25494
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CraftCMS Craft CMSCraft has a SSRF in GraphQL Asset Mutation via HTTP Redirect

Risk 29
Severity
6.9
EPSS
0.01%
First published (updated )
CVE-2026-25493

composer/craftcms/craftCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Risk 27
Severity
6.5
EPSS
0.01%
First published (updated )
CVE-2026-25492

Craft CraftCraft has a Stored XSS in Entry Types Name

Risk 22
Severity
4.8
EPSS
0.01%
First published (updated )
CVE-2026-25491

CraftCMS Craft CMSCraft Potential Remote Code Execution via Twig SSTI

Risk 66
Severity
7.2
First published (updated )
CVE-2025-57811

composer/craftcms/cmsCraft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Risk 65
Severity
6.9
Exploited
First published (updated )
CVE-2025-35939
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CraftCMS Craft CMSCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

Risk 51
Severity
7.3
EPSS
0.42%
First published (updated )
CVE-2025-46731

BleepingComputerCraft CMS RCE exploit chain used in zero-day attacks to steal data

Exploited
Zeroday
First published (updated )
News
BleepingComputer

BleepingComputerDHS says CISA will not stop monitoring Russian cyber threats

Exploited
First published (updated )
News
BleepingComputer

BleepingComputerCISA flags Craft CMS code injection flaw as exploited in attacks

Exploited
First published (updated )
News
BleepingComputer

CraftCMS Craft CMSCraft CMS Code Injection Vulnerability

Risk 75
Severity
8.1
Exploited
Zeroday
EPSS
0.04%
First published (updated )
CVE-2025-23209
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203