Where
-Infinity
0

Trending

Last week
Last month
Last year

Statamic StatamicStatamic: Unsafe method invocation via query value resolution allows data destruction

Risk 60
Severity
8.1
First published (updated )
CVE-2026-41175

composer/statamic/cmsStatamic allows unauthorized content access through missing authorization in its revision controllers

Risk 25
Severity
5.4
EPSS
0.02%
First published (updated )
CVE-2026-33887

composer/statamic/cmsStatamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2026-33886

composer/statamic/cmsStatamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Risk 38
Severity
6.1
First published (updated )
CVE-2026-33885

composer/statamic/cmsStatamic's live preview token bypasses content protection for unrelated entries

Risk 22
Severity
4.3
First published (updated )
CVE-2026-33884
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

Risk 38
Severity
6.1
First published (updated )
CVE-2026-33883

composer/statamic/cmsStatamic's Markdown preview endpoint exposes sensitive user data

Risk 38
Severity
6.5
First published (updated )
CVE-2026-33882

composer/statamic/cmsStatamic is missing authorization check on taxonomy term creation via fieldtype

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-33177

composer/statamic/cmsStatamic has a path traversal in file dictionary fieldtype

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-33171

composer/statamic/cmsStatamic has Stored XSS via SVG Sanitization Bypass

Risk 45
Severity
8.7
EPSS
0.01%
First published (updated )
CVE-2026-33172
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

statamic/statamicStatamic: privilege escalation via stored cross-site scripting

Risk 25
Severity
5.4
EPSS
0.01%
First published (updated )
CVE-2026-32612

composer/statamic/cmsStatamic vulnerable to privilege escalation via stored cross-site scripting

Risk 45
Severity
8.7
EPSS
0.03%
First published (updated )
CVE-2026-28426

composer/statamic/cmsStatamic vulnerable to remote code execution via Antlers-enabled control panel inputs

Risk 52
Severity
8
EPSS
0.14%
First published (updated )
CVE-2026-28425

npm/statamicStatamic's missing authorization allows access to email addresses

Risk 27
Severity
6.5
EPSS
0.03%
First published (updated )
CVE-2026-28424

Statamic StatamicStatamic Vulnerable to Server-Side Request Forgery via Glide

Risk 34
Severity
8.6
EPSS
0.06%
First published (updated )
CVE-2026-28423
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Statamic StatamicStatamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Risk 56
Severity
8.8
EPSS
0.01%
First published (updated )
CVE-2026-27939

composer/statamic/cmsStatamic is vulnerable to account takeover via password reset link injection

Risk 47
Severity
9.3
EPSS
0.01%
First published (updated )
CVE-2026-27593

composer/statamic/cmsStatamic affected by privilege escalation via stored Cross-site Scripting

Risk 41
Severity
8.1
EPSS
0.03%
First published (updated )
CVE-2026-27196

composer/statamic/cmsStatmatic affected by privilege escalation via stored cross-site scripting

Risk 45
Severity
8.7
EPSS
0.01%
First published (updated )
CVE-2026-25759

composer/statamic/cmsStatamic's missing authorization allows access to assets

Risk 16
Severity
4.3
EPSS
0.01%
First published (updated )
CVE-2026-25633
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/statamic/cmsStatamic account takeover via XSS and password reset link

Risk 40
Severity
8.2
EPSS
0.05%
First published (updated )
CVE-2024-24570

Statamic StatamicStatamic's Antlers sanitizer cannot effectively sanitize malicious SVG

Risk 40
Severity
5.5
First published (updated )
CVE-2023-36828

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203