Critical
CVE-2026-55791
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 127
Reset filters
High
CVE-2026-44012
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
High
CVE-2026-44011
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
High
CVE-2026-44010
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Medium
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Medium
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
Medium
CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Low
CVE-2026-56385
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Medium
CVE-2026-33162
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Low
CVE-2026-33161
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Low
CVE-2026-33160
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Medium
CVE-2026-33159
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Medium
CVE-2026-33158
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
High
CVE-2026-33157
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
Medium
CVE-2026-33051
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
High
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
High
CVE-2026-32264
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
High
CVE-2026-32263
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Medium
CVE-2026-32262
Craft CMS has a Path Traversal Vulnerability in AssetsController
Low
CVE-2026-56381
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
High
CVE-2026-31857
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
High
CVE-2026-31858
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
Medium
CVE-2026-31859
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Low
CVE-2026-29113
Craft CMS has a potential information disclosure vulnerability in preview tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.