CVE security advisories and vulnerability history for craft cms by craftcms.
133
Total CVEs
Published
4
In CISA KEV
Exploited in the wild
60
Public exploits
PoC or exploit code
6.8
Avg CVSS
2017–2026
Last updated
Overview
craftcms craft cms has 133 published CVE records since 2017, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 60 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.
Severity and exploitation
How the CVSS severity of craftcms craft cms's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
Critical13
High52
Medium63
Low5
In CISA’s Known Exploited Vulnerabilities catalog
4
4 of craftcms craft cms's CVEs are confirmed exploited in the wild.
Public exploits
60
60 of craftcms craft cms's CVEs have a known public exploit available.
Affected versions and CVEs
Browse every craftcms craft cms version named in a CVE, then pick one to see only the CVEs that affect it.
Version ranges
5.0.0 <= v <= 5.0.038 CVEs
4.0.0 <= v <= 4.0.032 CVEs
4.0.0 <= v < 4.17.09 CVEs
5.0.0 <= v < 5.10.119 CVEs
5.0.0 <= v < 5.9.09 CVEs
5.0.0 <= v < 5.10.66 CVEs
5.0.0 <= v < 5.8.226 CVEs
4.0.0 <= v < 4.16.185 CVEs
4.0.0 <= v < 4.18.25 CVEs
4.2.0.1 <= v <= 4.2.0.15 CVEs
5.0.1 <= v < 5.8.215 CVEs
Common weakness types
The CWE weakness categories most often found in craftcms craft cms CVEs. Follow any weakness for its full explanation.
Common questions about craftcms craft cms vulnerabilities.
How many CVEs does craftcms craft cms have?
craftcms craft cms has 133 published CVE records since 2017.
How many craftcms craft cms CVEs are in CISA KEV?
Yes — 4 of craftcms craft cms's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for craftcms craft cms vulnerabilities?
Yes — 60 of craftcms craft cms's CVEs have a known public exploit.
Which versions of craftcms craft cms are affected?
209 distinct craftcms craft cms versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in craftcms craft cms CVEs?
craftcms craft cms's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).
How many critical craftcms craft cms vulnerabilities are there?
craftcms craft cms has 13 critical and 52 high-severity CVEs.
What is the average severity of craftcms craft cms CVEs?
The average CVSS base score across craftcms craft cms's scored CVEs is 6.8.
