P
Vendor security profile
Pimcore
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical2
CISA KEV0
Public exploit3
Patch rate%57
Avg. CVSS8.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
4
2
1
CVE KEV
CVE severity distribution
7toplam CVE
Critical2 (29%)
High4 (57%)
Medium1 (14%)
Patch and exploitation view
%57
Verified patch
%0
CISA KEV
%43
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
5.1
CVE-2026-109392
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
P
Patch status unknown
8.8
CVE-2026-55416
Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
P
Patch verifiedEPSS %1
8.5
CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
P
Patch verifiedEPSS %0
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
P
Patch verifiedEPSS %1
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
P
Patch verifiedEPSS %1
8.8
CVE-2026-44741
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
P
Patch status unknownEPSS %1
8.8
CVE-2026-72562
Pimcore pimcore admin-ui-classic-bundle - SQL Injection
P
Patch status unknownEPSS %0
8.6
CVE-2026-11407
Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
PG
Patch verifiedEPSS %1