Vulnerabilities in craftcms

147 results
Vexday analysis

O Craft CMS acumula 98 CVEs catalogadas, com uma taxa de exploração ativa que está bem acima da média do catálogo CISA KEV — 6,8 vezes superior —, sinalizando que vulnerabilidades nessa plataforma atraem atenção de agentes maliciosos de forma desproporcional. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), embora o risco mais imediato esteja concentrado na CVE-2025-32432, atualmente em exploração ativa e com EPSS de 0,998, indicando probabilidade altíssima de exploração em ambiente real. O volume de 16 CVEs surgidas nos últimos 90 dias reforça um ritmo de descoberta acelerado, exigindo ciclos de atualização frequentes por parte das equipes responsáveis por instâncias em produção. A presença de 3 CVEs no KEV, 5 de severidade crítica e 3 com PoC pública torna a priorização de patches não apenas recomendável, mas urgente.

CVE-2026-28782MEDIUMCraft has a Permission Bypass and IDOR in Duplicate Entry ActionEPSS 0.2%CVE-2026-29176MEDIUMCraft Commerce has Stored XSS in Inventory Location NameEPSS 0.2%CVE-2026-72782HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakEPSS 0.2%CVE-2026-72780HIGHCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyEPSS 0.2%CVE-2026-72779HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectEPSS 0.2%CVE-2026-27126MEDIUMCraft CMS has Stored XSS in Table Field via "HTML" Column TypeEPSS 0.2%CVE-2026-33161LOWCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersEPSS 0.2%CVE-2026-29177LOWCraft Commerce has Stored XSS in Craft Commerce Order Details SlideoutEPSS 0.2%CVE-2026-29175HIGHMultiple Stored XSS in Commerce Inventory Page Leading to Session HijackingEPSS 0.2%CVE-2026-84798HIGHCraft CMS before 5.10.11 Authorization Bypass via actionDeleteForSiteEPSS 0.2%CVE-2026-84794HIGHCraft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assetEPSS 0.2%CVE-2026-84800HIGHCraft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-fileEPSS 0.2%CVE-2026-72785CRITICALCraft CMS before 5.10.6 Authorization Bypass via structures/move-elementEPSS 0.2%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2026-86731HIGHCraft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersControllerEPSS 0.2%CVE-2026-84792MEDIUMCraft CMS before 5.10.11 Broken Access Control via element-indexesEPSS 0.2%CVE-2026-27128MEDIUMCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limitEPSS 0.2%CVE-2026-29113LOWCraft has a potential information disclosure vulnerability in preview tokensEPSS 0.2%CVE-2026-84797MEDIUMCraft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicateEPSS 0.2%