CVE Tools
Track your stack

Wintercms

9 CVEs tracked since 2026. Since Aug 2026, none of them reached CISA KEV.

Wintercms CVEs per month

Aug 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Wintercms CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0890
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Wintercms's monthly top three, with their CVEs summed over those months.

  1. Winter91 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Wintercms.

  1. CVE-2026-63179Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets4.9
  2. CVE-2026-54256Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata5.4
  3. CVE-2026-32639Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads6.8
  4. CVE-2026-32593Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax5.9
  5. CVE-2026-32258Winter: Stored XSS through Editor Settings custom styles8.1
  6. CVE-2026-32257Winter: Stored XSS through Brand Settings custom styles8.1
  7. CVE-2026-35445Winter: Authenticated backend users can bypass Users controller permission checks—
  8. CVE-2026-79774Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy8.4
  9. CVE-2026-79773Winter CMS before 1.2.13 Local File Inclusion via JavaScript4.9
  10. CVE-2026-27591Winter: Privilege escalation by authenticated backend users9.9
  11. CVE-2026-22254Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager—
  12. CVE-2024-54149Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion8.4
  13. CVE-2024-32003Dusk plugin may allow unfettered user authentication in misconfigured installs8.8
  14. CVE-2024-29686Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE...7.2
  15. CVE-2023-52085Winter CMS Local File Inclusion through Server Side Template Injection 3.3

The record

Peak rank
#187 in Aug 2026
Busiest month shown
Aug 2026, 9 CVEs
Months with a KEV entry
0 since Aug 2026
Monthly snapshots
1 since 2026
Wintercms's full record, month by month