How many craftcms cms CVEs are in CISA KEV?

Yes — 4 of craftcms cms's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of craftcms cms are affected?

1,125 distinct craftcms cms versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in craftcms cms CVEs?

craftcms cms's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-918 (Server-Side Request Forgery (SSRF)).

How many critical craftcms cms vulnerabilities are there?

craftcms cms has 12 critical and 50 high-severity CVEs.

What is the average severity of craftcms cms CVEs?

The average CVSS base score across craftcms cms's scored CVEs is 6.7.

craftcms cms Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: craftcms cms vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

craftcms cms Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

craftcms cms has 134 published CVE records since 2017, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 47 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting craftcms cms, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of craftcms cms's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical12

High50

Medium68

Low4

In CISA’s Known Exploited Vulnerabilities catalog

4 of craftcms cms's CVEs are confirmed exploited in the wild.

Public exploits

47 of craftcms cms's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every craftcms cms version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2.0.252438 CVEs
2.0.252538 CVEs
2.0.252738 CVEs
2.0.253238 CVEs
2.0.253338 CVEs
2.0.253538 CVEs
2.0.253638 CVEs
2.0.253738 CVEs
2.0.253838 CVEs
2.0.253938 CVEs
2.1.0-alpha.254638 CVEs
2.1.0-alpha.254738 CVEs

Common weakness types

The CWE weakness categories most often found in craftcms cms CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many craftcms cms CVEs were published each year.

2017

2018

2019

2020

2021

2022

2023

Other craftcms products

Browse vulnerabilities for other products by craftcms.

craftcms/cms123 CVEs craft cms97 CVEs commerce21 CVEs craftcms/commerce20 CVEs craft commerce17 CVEs aws-s31 CVEs azure-blob1 CVEs CraftCMS1 CVEs

Frequently asked questions

Common questions about craftcms cms vulnerabilities.

How many CVEs does craftcms cms have?: craftcms cms has 134 published CVE records since 2017.
How many craftcms cms CVEs are in CISA KEV?: Yes — 4 of craftcms cms's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for craftcms cms vulnerabilities?: Yes — 47 of craftcms cms's CVEs have a known public exploit.
Which versions of craftcms cms are affected?: 1,125 distinct craftcms cms versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in craftcms cms CVEs?: craftcms cms's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-918 (Server-Side Request Forgery (SSRF)).
How many critical craftcms cms vulnerabilities are there?: craftcms cms has 12 critical and 50 high-severity CVEs.
What is the average severity of craftcms cms CVEs?: The average CVSS base score across craftcms cms's scored CVEs is 6.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track craftcms cms vulnerabilities

Monitor new craftcms cms vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

Fixed in

8e23a7a14d50f169c10a487348c993384d479e069 CVEs
13c50dd550fabe74fe5317aeca090d286f1c75568 CVEs
42cef196d68dd8d48ceaab89b2c9e2edd2cecbe88 CVEs
0ad14c3c7e590461b52aeb44859659e2e231e04d7 CVEs
5.10.67 CVEs
5c055703a13ba3a52bf013d7ba6c0223d6f62ef87 CVEs
3262cfa628ade304f0e565f9e45b52fab0f32df36 CVEs
4.18.26 CVEs
c7ea105e1d2cf043e76e7847d84e5732071a26b46 CVEs
1a8db788c8b3de85c3aed09ac34046e2300794815 CVEs
8582f04f8346c6cf285a18d9704c4a2d9371e9bf5 CVEs
b5f17cd3246cf10034a914464964757b0b84bcd35 CVEs
daf0ed01c7d2c194ba4a405290e43934d020eef25 CVEs
fc466946af3dd7928f5fd0e26099b9dc0eb2ce725 CVEs
7882526a2a26ab6d515604b7f0a0a04eb1760e254 CVEs
5.9.143 CVEs
84d783586bf0abf619a9d1909d93fdfdcaaf73a43 CVEs
a516a6190ba8ef39a7603863df9ae09eb89f3a643 CVEs
c14474f31e4b8e5464c92c8f0d84753c96fef2883 CVEs
17bf79c1dbc249b6c79d585eba1414838dc435212 CVEs
250aa0add8d0ea0bed537e5a85ad519309f2db6b2 CVEs
4.17.82 CVEs
4.18.32 CVEs
5.10.72 CVEs
5.10.82 CVEs
50b1db3a69cd9f865829fbabf1afad8a72fc15702 CVEs
6a08356668f772f0a4d79769d3de83508cd4e21c2 CVEs
7896d0ec2bd9deaa7809404604f00b949f208afa2 CVEs
79198636a24ce405d8365e1bc281b3405313ccbf2 CVEs
81bc48f0ce79dbdaac30b618ec8af746479334fa2 CVEs
887cc875cf041f6d0ecc55c7a0a687c41b402a242 CVEs
a65e9f5b33801cd89d859cee78573fd04df1ed572 CVEs
ade6b5b843c82df6ac1661c453f1812294bdbef72 CVEs
b4ff213cd88743cf08829e86281dc95c57fc83b82 CVEs
cedeba0609e4b173cd584dae7f33c5f713f196272 CVEs
d30df3112220db1ffd6726a3ed11857014c7fb272 CVEs
e370b5a098420ef2fe9c569c17ed2bfe047bebd92 CVEs
f7fbf335ac15665372670b61046032f5f404f69a2 CVEs
00fb253d5318e10204433e5d93934108e574005e1 CVE
026ea62a0a4c156c560c559336f1b6f0bf970b791 CVE
02739d27edfc4eea0749ee2c3aedbc91745f998c1 CVE
02c00d5b58683b85c8b4e04bdc66fae1d987a2931 CVE
053d7119697e480ff81c5723bb9a33eaa49e0fc71 CVE
06a4916ff0ed510bc439014701662b641df7ef231 CVE
0a650c4f4080bc6c44e9f1a6d0cdf536a15a51c81 CVE
0a6b916f6367b0162b2eaf2366add67b45fa98ea1 CVE
0ee66d29281af2b6c4f866e1437842c61983a6721 CVE
12324d122925f089f765165c01c7fdd33b2ff4941 CVE
19ce0bab651ab52c7b394f5f4a2ed0621ba90bd71 CVE
1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b1 CVE
243c576a4317fa075e6876b4af0ff2ed98de28671 CVE
273dfd3dadbb404f69ffd6d7f93451497bbd811c1 CVE
2c2447caaed72c1edb443cfbea4d7cbc64e416751 CVE
2f9ef3ed80295c763eae9d9af96401336d0645a21 CVE
30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c1 CVE
31c8d3e485c8f39ae438cee83805edb9a8123d3e1 CVE
3ce66732d97093cc4be3aaf67c661bae6e8d2d451 CVE
4.16.191 CVE
4.17.0-beta.11 CVE
4.17.71 CVE
43dc9cfba1d5ccb1cd0b5da4ff1ab6459db268111 CVE
4477bfd70abefa77c34574238499764522a6ff4f1 CVE
5.10.51 CVE
5.8.221 CVE
5.8.231 CVE
5.9.0-beta.11 CVE
5.9.131 CVE
5020fa5be830af712694f9f8164599a1789cc0941 CVE
558372701d7870da4a3cda88592a21d962de0cb11 CVE
5a47f8acc15201e95063b34b0c3cc4d81b2024931 CVE
5ad0b36612ad190c841bd55cc05fcebc299ac1d71 CVE
5ef456281de838d9180c6bfb2f1b8de74268b4241 CVE
5f69bc4f699e6f97a90c057584e720a808c80b981 CVE
609a87b01080720b8a6c33866c33018aeb32fc0a1 CVE
6432eca59b93bcea2ca2616199e5d419447e613f1 CVE
65ab659cb6c914c7ad671af1e417c0da2431f79b1 CVE
67780a778c6ec04e68e64a0b1177c168306144a21 CVE
679b82edce8c60ce1008dc70740bf2610adac57d1 CVE
74eb5d3a9ffa935df1a4fc2b6ddb1042d9f8e5821 CVE
7655e1009ba6cdbfb230e6bb138b775b69fc7bcb1 CVE
76a2168b6a5e30144f5c06da4ff264f4eca577ff1 CVE
76de732e423edc1c13382ecdbc90673492f5647d1 CVE
777b2f0154e998dd1c5ebacf3caffe7f02639ec21 CVE
77993d4fecd403296c949dbf1ce84aabeeb4c5d61 CVE
77b7c3a28dcf063163706f508101c16a8e77eed91 CVE
79c68d9f00ece882c0e9c336e4545fef5f9b06a71 CVE
7a95af9c44a6b7b017ab201ebc717d09524724191 CVE
7ad3a61e84c0266d24e34d8ce3ebd13154d60b921 CVE
7dc8d2d258cfe8da9bbecf13e5c478c4c64934e11 CVE
81856f0d33c233ff58d07ef9bac5dcb5db5f058c1 CVE
84bda0c406cea052bdf6cd30b44a60e52757f9ee1 CVE
8c2ad0bd313015b8ee42326af2848ee748f1d7661 CVE
8c354fc15b0fba8a8b9363f0f98883a76e57795f1 CVE
8de55f65dfaeef07038578a3aa441729af7aeb491 CVE
8ee85a8f03c143fa2420e7d6f311d95cae3b19ce1 CVE
8f6587c25050bbb6e080d59c71f6bb8932fc86001 CVE
943152d2246b36f12adf161a03b8695b773d92761 CVE
964fec5696fd72e4009ca43c646cda90a60adc6c1 CVE
969a4575fb7337ac2d33f8a4de7a8d024a3928881 CVE
98ed4420853ba7d9cf0d430881e673f7fcf498261 CVE
9986382fbf26ed5cd46926ecd84084bf1b5646801 CVE
9bd05c91e6a7e6da5e949ec41a31c220c059aa041 CVE
9c43399c75a5aa0385eb9e264fbac9bcebd8cadd1 CVE
9cc493be8b414d7116c7f2bc2a6d0926e73f12481 CVE
9e2781f26f5972aaba333f20b07b33514ce84c031 CVE
9ee53efc1314e6aba32771c66a13e072a246f4ce1 CVE
a17667bd7ba7e69c4eb19eb7d13f039a6904e1301 CVE
a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f1 CVE
a54e725a3ad01da409d466e30369855642845a411 CVE
a8eda73630e3466ad8a48c5402555e49e13115921 CVE
b024ed46ab876900feb4b85589ccddbe1c00658e1 CVE
b2515b0ce6ae02e8582ce5a10841cb933899cbe31 CVE
b38439ac3815a0a56c9f4cca34db5ddb1ce15dca1 CVE
b585c8006d649fc94e12bb6dcf321979d33900861 CVE
b77cb3023bed4f4a37c11294c4d319ff9f598e1f1 CVE
ba3b1e704194e7e6a056595d0d9cededc7e9b9c31 CVE
bee9366fd101ff5da96cc71eb5464a501520be411 CVE
c06b418e11cc712f8353ae2338ac9880dcbe68891 CVE
c0a37e15cc925c473e60e27fe64054993b867ac11 CVE
c17728fa0bec11d3b82c34defe0930ed409aec381 CVE
cdc9cb66d0716c9552e4113c8e426fd1a31f95161 CVE
d44a2d4628b02db2290ecff4248ba70f664c070d1 CVE
e1a3dd669ae31491b86ad996e88a1d30d33d9a421 CVE
f7702ae97d20f0c2d41b97a8fc39ede5275795941 CVE
f781aecea946641c1c66baa5cf4a39872f99e7c61 CVE
f9378aa154b5f9b64bed3d59cce0c4a8184bf5e61 CVE
facd869038f403c4b7b1fefeb88038ea8deb2f6a1 CVE