Vulnerabilities in craftcms
168 resultsCVE-2026-28782MEDIUMCraft has a Permission Bypass and IDOR in Duplicate Entry ActionEPSS 0.3%CVE-2026-29176MEDIUMCraft Commerce has Stored XSS in Inventory Location NameEPSS 0.3%CVE-2026-72785CRITICALCraft CMS before 5.10.6 Authorization Bypass via structures/move-elementEPSS 0.3%CVE-2026-92589MEDIUMCraft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorderEPSS 0.3%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.3%CVE-2026-33051MEDIUMCraft CMS Vulnerable to Stored XSS in Revision Context MenuEPSS 0.3%CVE-2026-84793MEDIUMCraft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site nameEPSS 0.3%CVE-2026-41128MEDIUMCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionEPSS 0.2%CVE-2026-27126MEDIUMCraft CMS has Stored XSS in Table Field via "HTML" Column TypeEPSS 0.2%CVE-2026-29177LOWCraft Commerce has Stored XSS in Craft Commerce Order Details SlideoutEPSS 0.2%CVE-2026-72784MEDIUMCraft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutationEPSS 0.2%CVE-2026-29175HIGHMultiple Stored XSS in Commerce Inventory Page Leading to Session HijackingEPSS 0.2%CVE-2026-92590MEDIUMCraft CMS 5.7.0 before 5.10.13 Stored XSS via Generated FieldsEPSS 0.2%CVE-2026-109306MEDIUMCraft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-editionEPSS 0.2%CVE-2026-56393MEDIUMCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field OptionsEPSS 0.2%CVE-2026-33161LOWCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersEPSS 0.2%CVE-2026-56383MEDIUMCraft CMS - Stored XSS in Table Field via Row Heading Column TypeEPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2026-29113LOWCraft has a potential information disclosure vulnerability in preview tokensEPSS 0.2%CVE-2026-72783MEDIUMCraft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContainedEPSS 0.2%