Medium
CVE-2026-71435
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 44
Reset filters
Medium
CVE-2026-71434
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Medium
CVE-2026-64662
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Medium
CVE-2026-64663
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
High
CVE-2026-64665
Statamic: Account takeover via OAuth email matching without email-verification check
Medium
CVE-2026-64664
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Medium
CVE-2026-71293
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
Low
CVE-2026-54244
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Medium
CVE-2026-54242
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
High
CVE-2026-49287
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
Medium
CVE-2026-49288
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
Medium
CVE-2026-45660
Statamic CMS: Server-Side Request Forgery via Glide
Medium
CVE-2026-44306
Statamic CMS vulnerable to email enumeration via forgot password endpoint
High
CVE-2026-41175
Statamic: Unsafe method invocation via query value resolution allows data destruction
Medium
CVE-2026-33887
Statamic allows unauthorized content access through missing authorization in its revision controllers
Medium
CVE-2026-33886
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
Medium
CVE-2026-33885
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Medium
CVE-2026-33884
Statamic's live preview token bypasses content protection for unrelated entries
Medium
CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Medium
CVE-2026-33882
Statamic's Markdown preview endpoint exposes sensitive user data
Medium
CVE-2026-33177
Statamic is missing authorization check on taxonomy term creation via fieldtype
Medium
CVE-2026-33171
Statamic has a path traversal in file dictionary fieldtype
High
CVE-2026-33172
Statamic has Stored XSS via SVG Sanitization Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.