Craft CMS security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Craft CMS. Vendor security advisories are linked on this page.
Built for Operators of this product.
153 public records · 0 security-fix timeline events. 0 published in the last 7 days. 120 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 17
- Medium 7
- Low 4
2026-08-0829 issues2026-11-05
Known exploited
View all known exploited- Medium6.9Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityPatch nowKEVEPSS 1.35%May 7, 2025
- Critical9.3Craft CMS Code Injection VulnerabilityPatch nowKEVEPSS 97.48%Dec 18, 2024
- Critical10.0Craft CMS Code Injection VulnerabilityPatch nowKEVEPSS 99.79%Apr 18, 2025
- Critical9.8Yiiframework Yii Improper Protection of Alternate Path VulnerabilityPatch nowKEVEPSS 87.76%Apr 9, 2025
- High8.1Craft CMS Code Injection VulnerabilityPatch nowKEVEPSS 21.64%Jan 17, 2025
- Critical9.8craftcms Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 72.82%Mar 4, 2020
- Critical9.8craftcms Craft CMS Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 94.22%Sep 13, 2023
Recently published
Browse catalog- MediumUnauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scopeOpen the advisoryOct 23, 2026
- MediumAnonymous GraphQL clients can read out-of-scope section contentOpen the advisoryOct 23, 2026
- MediumPublic registration inherits direct permissions from a deactivated accountOpen the advisoryOct 23, 2026
- HighLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEOpen the advisoryOct 23, 2026
- HighControl panel only API response emulation replaces "securityKey" and reaches server RCEOpen the advisoryOct 23, 2026
- High"app/render-elements" return URL signing oracle leads to RCEOpen the advisoryOct 23, 2026
- HighSQL injection leading to privilege escalationOpen the advisoryOct 22, 2026
- HighControl panel only blind SQL injection through "getNext"/"getPrev" criteriaOpen the advisoryOct 22, 2026
- HighControl panel only administrator privilege escalation through sandbox allowed "getOwners(criteria)"Open the advisoryOct 22, 2026
- HighUnauthenticated SQL injection via GraphQL eager-load "select" criteriaOpen the advisoryOct 22, 2026