Vulnerabilities in statamic
33 resultsCVE-2025-64112HIGHStatmatic vulnerable to Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-28424MEDIUMStatamic's missing authorization allows access to email addressesEPSS 0.2%CVE-2026-32612MEDIUMStatamic: privilege escalation via stored cross-site scriptingEPSS 0.2%CVE-2026-33177MEDIUMStatamic is missing authorization check on taxonomy term creation via fieldtypeEPSS 0.2%CVE-2026-33886MEDIUMStatamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsEPSS 0.2%CVE-2026-44306MEDIUMStatamic: Email enumeration via forgot password endpointEPSS 0.2%CVE-2026-33885MEDIUMStatamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialEPSS 0.2%CVE-2026-33884MEDIUMStatamic's live preview token bypasses content protection for unrelated entriesEPSS 0.2%CVE-2026-49288MEDIUMStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesEPSS 0.2%CVE-2026-45660MEDIUMStatamic: Server-Side Request Forgery via GlideEPSS 0.2%CVE-2026-33883MEDIUMStatamic has Reflected XSS via unescaped redirect parameter in its password reset form tagEPSS 0.1%CVE-2026-33887MEDIUMStatamic allows unauthorized content access through missing authorization in its revision controllersEPSS 0.1%CVE-2024-36119LOWPassword confirmation stored in plain text via registration form in statamic/cmsEPSS 0.1%