Pimcore

This hub aggregates every CVE we track for Pimcore, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Pimcore.

• CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Name9.9Aug 28, 2026
• CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter8.8Aug 12, 2026
• CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column Configuration8.7Jul 17, 2026
• CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling8.1Jul 17, 2026
• CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document Export6.4Jul 17, 2026
• CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction8.0Jul 17, 2026
• CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass8.8Jul 9, 2026
• CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes7.7Jul 9, 2026
• CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation7.1Jul 9, 2026
• CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering5.4Apr 27, 2026
• CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause4.9Feb 24, 2026
• CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization5.4Jan 15, 2026
• CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listing4.3Jan 15, 2026
• CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing4.3Jan 15, 2026
• CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_log8.6Jan 15, 2026