High
CVE-2026-29069
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 127
Reset filters
Medium
CVE-2026-28784
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2026-28782
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
Medium
CVE-2026-28783
Craft CMS has Twig Function Blocklist Bypass
Medium
CVE-2026-28781
Craft CMS: Entries Authorship Spoofing via Mass Assignment
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Low
CVE-2026-56393
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
High
CVE-2026-28696
Craft CMS has IDOR via GraphQL @parseRefs
Medium
CVE-2026-28695
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Low
CVE-2026-56383
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Medium
CVE-2026-27128
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-27126
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2026-25497
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Medium
CVE-2026-25496
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
High
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Medium
CVE-2026-25494
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
Medium
CVE-2026-25493
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
Low
CVE-2026-25491
Craft CMS Vulnerable to Stored XSS in Entry Types Name
High
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
Medium
CVE-2025-68454
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.