Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationCVE-2026-109307 · craftcms · cms · CIRCL Vulnerability Lookup · CVE.org · FIRST EPSS · Craft CMSEPSS 0.2%Oct 12, 2026
Medium6.9Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityCVE-2025-35939 · craftcms · craft cms · CISA KEV · CVE.org · FIRST EPSS · Craft CMSKEVEPSS 1.3%May 7, 2025
Critical10.0Craft CMS Code Injection VulnerabilityCVE-2025-32432 · Craft CMS · Craft CMS · CISA KEV · CVE.org · FIRST EPSS · Craft CMSKEVEPSS 99.8%Apr 25, 2025
Critical9.8Yiiframework Yii Improper Protection of Alternate Path VulnerabilityCVE-2024-58136 · yiiframework · yii · CISA KEV · CVE.org · FIRST EPSS · Craft CMSKEVEPSS 87.8%Apr 9, 2025
High8.1Craft CMS Code Injection VulnerabilityCVE-2025-23209 · craftcms · craft cms · CISA KEV · CVE.org · FIRST EPSS · Craft CMSKEVEPSS 21.8%Jan 17, 2025
Critical9.3Craft CMS Code Injection VulnerabilityCVE-2024-56145 · craftcms · craft cms · CISA KEV · CVE.org · FIRST EPSS · Craft CMSKEVEPSS 97.4%Dec 18, 2024