Cms

This hub aggregates every CVE we track for Cms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Cms.

• CVE-2026-71435Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template6.1Aug 6, 2026
• CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types5.3Aug 6, 2026
• CVE-2026-64662Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries6.5Aug 6, 2026
• CVE-2026-64663Statamic: Unsafe method invocation via Antlers template resolution allows data destruction6.5Aug 6, 2026
• CVE-2026-64665Statamic: Account takeover via OAuth email matching without email-verification check8.1Aug 6, 2026
• CVE-2026-64664Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence4.3Aug 6, 2026
• CVE-2026-5134SQLi in Loca Software's CMS9.8Aug 6, 2026
• CVE-2026-71293Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable6.2Aug 5, 2026
• CVE-2026-16219Croogo CMS Admin File Manager FileManager.php isEditable path traversal6.3Jul 19, 2026
• CVE-2026-16205Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting2.4Jul 19, 2026
• CVE-2026-54243Statamic: CSV formula injection in form submission exports6.1Jul 17, 2026
• CVE-2026-54242Statamic: Server-Side Request Forgery via Glide (DNS rebinding)4.9Jul 17, 2026
• CVE-2026-54244Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors3.5Jul 17, 2026
• CVE-2026-14794Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization4.3Jul 6, 2026
• CVE-2026-14793Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization4.3Jul 6, 2026