CVE security advisories and vulnerability history for craft cms by craftcms.
97
Total CVEs
Published
4
In CISA KEV
Exploited in the wild
37
Public exploits
PoC or exploit code
6.7
Avg CVSS
2017–2026
Last updated
Overview
craftcms craft cms has 97 published CVE records since 2017, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 37 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.
This page aggregates every publicly disclosed vulnerability (CVE) affecting craftcms craft cms, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.
Severity and exploitation
How the CVSS severity of craftcms craft cms's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
Critical10
High32
Medium51
Low4
In CISA’s Known Exploited Vulnerabilities catalog
4
4 of craftcms craft cms's CVEs are confirmed exploited in the wild.
Public exploits
37
37 of craftcms craft cms's CVEs have a known public exploit available.
Affected versions and CVEs
Browse every craftcms craft cms version named in a CVE, then pick one to see only the CVEs that affect it.
Version ranges
5.0.0 <= v <= 5.0.038 CVEs
4.0.0 <= v <= 4.0.032 CVEs
4.0.0 <= v < 4.17.09 CVEs
5.0.0 <= v < 5.9.09 CVEs
5.0.0 <= v < 5.8.226 CVEs
4.0.0 <= v < 4.16.185 CVEs
4.2.0.1 <= v <= 4.2.0.15 CVEs
5.0.1 <= v < 5.8.215 CVEs
4.0.0 <= v < 4.17.84 CVEs
5.0.0 <= v < 5.9.144 CVEs
<= 2.6.29743 CVEs
Common weakness types
The CWE weakness categories most often found in craftcms craft cms CVEs. Follow any weakness for its full explanation.
Common questions about craftcms craft cms vulnerabilities.
How many CVEs does craftcms craft cms have?
craftcms craft cms has 97 published CVE records since 2017.
How many craftcms craft cms CVEs are in CISA KEV?
Yes — 4 of craftcms craft cms's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for craftcms craft cms vulnerabilities?
Yes — 37 of craftcms craft cms's CVEs have a known public exploit.
Which versions of craftcms craft cms are affected?
183 distinct craftcms craft cms versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in craftcms craft cms CVEs?
craftcms craft cms's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).
How many critical craftcms craft cms vulnerabilities are there?
craftcms craft cms has 10 critical and 32 high-severity CVEs.
What is the average severity of craftcms craft cms CVEs?
The average CVSS base score across craftcms craft cms's scored CVEs is 6.7.
