CVE Tools
Track your stack

CMS

382 CVEs tracked. 6 of them are in CISA KEV.

This hub aggregates every CVE we track for CMS, a product in the web CMS plugins space. Use it to gauge the current risk picture and drill into individual advisories.

CMS CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
CMS CVEs per month
MonthCVEs
2024-116
2024-124
2025-012
2025-021
2025-032
2025-044
2025-054
2025-0617
2025-074
2025-086
2025-093
2025-106
2025-110
2025-121
2026-016
2026-0225
2026-0337
2026-0416
2026-055
2026-0612
2026-0719
2026-0821
2026-0935
2026-1021

Severity

How the 382 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical195%
  • High9627%
  • Medium19253%
  • Low5415%

Latest CVEs

The 15 most recently published vulnerabilities affecting CMS.

  1. CVE-2026-113358LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes7.5
  2. CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE7.2
  3. CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations9.8
  4. CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password7.5
  5. CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout7.2
  6. CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection8.8
  7. CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection8.8
  8. CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters6.5
  9. CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable8.8
  10. CVE-2026-112028light0011 cms Vote VoteController.class.php logic error6.5
  11. CVE-2026-112027light0011 cms Uploadify check-exists.php file_exists file information disclosure5.3
  12. CVE-2026-112026light0011 cms UserModel.class.php sha1 weak password hash3.7
  13. CVE-2026-112025light0011 cms Captcha Validation UserController.class.php access control7.3
  14. CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification4.7
  15. CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection8.8

Product grouping is registry-driven, with AI assist and human review. How it works