CVE Tools
Track your stack

CMS

388 CVEs tracked. 6 of them are in CISA KEV.

This hub aggregates every CVE we track for CMS, a product in the web CMS plugins space. Use it to gauge the current risk picture and drill into individual advisories.

CMS CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
CMS CVEs per month
MonthCVEs
2024-124
2025-012
2025-021
2025-032
2025-044
2025-054
2025-0617
2025-074
2025-086
2025-093
2025-106
2025-110
2025-121
2026-016
2026-0225
2026-0337
2026-0416
2026-055
2026-0612
2026-0719
2026-0821
2026-0935
2026-1023
2026-114

Severity

How the 388 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical205%
  • High10128%
  • Medium19252%
  • Low5415%

Latest CVEs

The 15 most recently published vulnerabilities affecting CMS.

  1. CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select8.2
  2. CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass8.8
  3. CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria7.1
  4. CVE-2026-123488Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint9.8
  5. CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE8.8
  6. CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCE8.8
  7. CVE-2026-113358LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes7.5
  8. CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE7.2
  9. CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password7.5
  10. CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations9.8
  11. CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout7.2
  12. CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection8.8
  13. CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection8.8
  14. CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters6.5
  15. CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable8.8

Product grouping is registry-driven, with AI assist and human review. How it works