Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how statamic compares to other vendors in security performance

View Risk Score →

Statamic Statamic CMSStatamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Risk 33
Severity
6.2
First published (updated )
CVE-2026-71293

composer/statamic/cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

Risk 22
Severity
4.3
First published (updated )
CVE-2026-49288

composer/statamic/cmsStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction

Risk 56
Severity
7.4
First published (updated )
CVE-2026-49287

Statamic StatamicStatamic: Unsafe method invocation via query value resolution allows data destruction

Risk 60
Severity
8.1
First published (updated )
CVE-2026-41175

composer/statamic/cmsStatamic allows unauthorized content access through missing authorization in its revision controllers

Risk 25
Severity
5.4
EPSS
0.02%
First published (updated )
CVE-2026-33887
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2026-33886

composer/statamic/cmsStatamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Risk 38
Severity
6.1
First published (updated )
CVE-2026-33885

composer/statamic/cmsStatamic's live preview token bypasses content protection for unrelated entries

Risk 22
Severity
4.3
First published (updated )
CVE-2026-33884

composer/statamic/cmsStatamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

Risk 38
Severity
6.1
First published (updated )
CVE-2026-33883

composer/statamic/cmsStatamic's Markdown preview endpoint exposes sensitive user data

Risk 38
Severity
6.5
First published (updated )
CVE-2026-33882
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic is missing authorization check on taxonomy term creation via fieldtype

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-33177

composer/statamic/cmsStatamic has a path traversal in file dictionary fieldtype

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-33171

composer/statamic/cmsStatamic has Stored XSS via SVG Sanitization Bypass

Risk 45
Severity
8.7
EPSS
0.01%
First published (updated )
CVE-2026-33172

statamic/statamicStatamic: privilege escalation via stored cross-site scripting

Risk 25
Severity
5.4
EPSS
0.01%
First published (updated )
CVE-2026-32612

composer/statamic/cmsStatamic vulnerable to privilege escalation via stored cross-site scripting

Risk 45
Severity
8.7
EPSS
0.03%
First published (updated )
CVE-2026-28426
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic vulnerable to remote code execution via Antlers-enabled control panel inputs

Risk 52
Severity
8
EPSS
0.14%
First published (updated )
CVE-2026-28425

npm/statamicStatamic's missing authorization allows access to email addresses

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2026-28424

Statamic StatamicStatamic Vulnerable to Server-Side Request Forgery via Glide

Risk 34
Severity
8.6
EPSS
0.06%
First published (updated )
CVE-2026-28423

Statamic StatamicStatamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Risk 56
Severity
8.8
EPSS
0.01%
First published (updated )
CVE-2026-27939

composer/statamic/cmsStatamic is vulnerable to account takeover via password reset link injection

Risk 47
Severity
9.3
EPSS
0.01%
First published (updated )
CVE-2026-27593
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic affected by privilege escalation via stored Cross-site Scripting

Risk 41
Severity
8.1
EPSS
0.03%
First published (updated )
CVE-2026-27196

composer/statamic/cmsStatmatic affected by privilege escalation via stored cross-site scripting

Risk 45
Severity
8.7
EPSS
0.01%
First published (updated )
CVE-2026-25759

composer/statamic/cmsStatamic's missing authorization allows access to assets

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-25633

Statamic Alt RedirectThe Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when t…

Risk 40
Severity
6.5
First published (updated )
CVE-2025-60868

Statamic CoreXSS, CSRF

Risk 79
Severity
8.8
First published (updated )
CVE-2020-9322
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic account takeover via XSS and password reset link

Risk 40
Severity
8.2
EPSS
0.05%
First published (updated )
CVE-2024-24570

composer/statamic/cmsStatamic CMS vulnerable to Cross-site Scripting via uploaded assets

Risk 57
Severity
7.5
First published (updated )
CVE-2023-48701

composer/statamic/cmsRemote code execution via form uploads in statamic/cms

Risk 80
Severity
8.8
First published (updated )
CVE-2023-48217

composer/statamic/cmsStatamic CMS remote code execution via front-end form uploads

Risk 88
Severity
9.8
First published (updated )
CVE-2023-47129

Statamic StatamicStatamic's Antlers sanitizer cannot effectively sanitize malicious SVG

Risk 40
Severity
5.5
First published (updated )
CVE-2023-36828
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203