O
Vendor security profile
octobercms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs5
Critical0
CISA KEV0
Public exploit1
Patch rate%20
Avg. CVSS4.6
12-month vulnerability rate
0
0
0
0
0
2
0
0
0
0
3
0
CVE KEV
CVE severity distribution
5toplam CVE
Medium3 (60%)
Low2 (40%)
Patch and exploitation view
%20
Verified patch
%0
CISA KEV
%20
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
3.3
CVE-2026-49400
October CMS: PHP Object Injection via Backend Widget Session Storage
O
Patch status unknownEPSS %0
3.3
CVE-2026-46696
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
O
Patch status unknownEPSS %0
4.8
CVE-2026-25133
Cross-site scripting in Octobercms
O
Patch status unknownEPSS %0
4.9
CVE-2026-25125
Code injection in Octobercms
O
Patch status unknownEPSS %0