CVE security advisories and vulnerability history for craftcms/cms by craftcms.
123
Total CVEs
Published
4
In CISA KEV
Exploited in the wild
44
Public exploits
PoC or exploit code
6.7
Avg CVSS
2017–2026
Last updated
Overview
craftcms craftcms/cms has 123 published CVE records since 2017, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 44 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.
This page aggregates every publicly disclosed vulnerability (CVE) affecting craftcms craftcms/cms, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.
Severity and exploitation
How the CVSS severity of craftcms craftcms/cms's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
Critical11
High46
Medium62
Low4
In CISA’s Known Exploited Vulnerabilities catalog
4
4 of craftcms craftcms/cms's CVEs are confirmed exploited in the wild.
Public exploits
44
44 of craftcms craftcms/cms's CVEs have a known public exploit available.
Affected versions and CVEs
Browse every craftcms craftcms/cms version named in a CVE, then pick one to see only the CVEs that affect it.
Version ranges
4.0.0-RC1 <= v < 4.17.0-beta.19 CVEs
5.0.0-RC1 <= v < 5.9.0-beta.18 CVEs
5.0.0-RC1 <= v < 5.8.227 CVEs
4.0.0-RC1 <= v < 4.17.86 CVEs
5.0.0-RC1 <= v < 5.9.146 CVEs
4.0.0-RC1 <= v < 4.16.185 CVEs
4.0.0-RC1 <= v < 4.2.15 CVEs
5.0.0-RC1 <= v < 5.10.65 CVEs
5.0.0-RC1 <= v < 5.8.215 CVEs
5.0.0-RC1 <= v < 5.8.235 CVEs
4.0.0-RC1 <= v < 4.18.24 CVEs
Common weakness types
The CWE weakness categories most often found in craftcms craftcms/cms CVEs. Follow any weakness for its full explanation.
Common questions about craftcms craftcms/cms vulnerabilities.
How many CVEs does craftcms craftcms/cms have?
craftcms craftcms/cms has 123 published CVE records since 2017.
How many craftcms craftcms/cms CVEs are in CISA KEV?
Yes — 4 of craftcms craftcms/cms's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for craftcms craftcms/cms vulnerabilities?
Yes — 44 of craftcms craftcms/cms's CVEs have a known public exploit.
Which versions of craftcms craftcms/cms are affected?
220 distinct craftcms craftcms/cms versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in craftcms craftcms/cms CVEs?
craftcms craftcms/cms's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-94 (Improper Control of Generation of Code ('Code Injection')).
How many critical craftcms craftcms/cms vulnerabilities are there?
craftcms craftcms/cms has 11 critical and 46 high-severity CVEs.
What is the average severity of craftcms craftcms/cms CVEs?
The average CVSS base score across craftcms craftcms/cms's scored CVEs is 6.7.
