C
Vendor security profile1 actively exploited CVEs
craftcms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs42
Critical4
CISA KEV1
Public exploit5
Patch rate%26
Avg. CVSS7.4
12-month vulnerability rate
0
0
5
0
1
0
0
0
0
12
21
1
CVE KEV
CVE severity distribution
42toplam CVE
Critical4 (10%)
High23 (55%)
Medium15 (36%)
Patch and exploitation view
%26
Verified patch
%2
CISA KEV
%12
Public exploit
11Patch available
0Partial
0Workaround
0Vendor: no patch
31Unknown
Latest vulnerabilities
8.7
CVE-2026-105985
Authenticated RCE via render-components Entry Type overrides
C
Patch verifiedEPSS %1
8.7
CVE-2026-92594
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
C
Patch status unknownEPSS %0
8.7
CVE-2026-92593
Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
C
Patch status unknownEPSS %1
8.7
CVE-2026-92592
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
C
Patch status unknownEPSS %1
8.2
CVE-2026-92591
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
C
Patch status unknownEPSS %0
5.1
CVE-2026-92590
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
C
Patch status unknownEPSS %0
5.3
CVE-2026-92589
Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
C
Patch status unknownEPSS %0
6.9
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
C
Patch status unknownEPSS %1
8.7
CVE-2026-79987
Low-privilege RCE through element-search eager loading
C
Patch verifiedEPSS %1
8.7
CVE-2026-86732
Craft CMS before 5.10.12 Remote Code Execution via element-index
C
Patch status unknownEPSS %1