Craft CMS vulnerabilities
3 published CVEs name Craft CMS among the affected products; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 3
- Last 12 months
- 2
- Critical
- 0
- Known exploited
- 1
Critical 0High 0Medium 3Low 0Not scored 0
CVEs per yearBy the year they were published
- 20251
- 20262
Known exploitedNewest addition to KEV first
- CVE-2025-35939
Craft CMS stores user-provided content in session files
Craft · CMS
ExploitedMedium6.9
Newest CVEs
- CVE-2026-14794
Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization
Craft · CMS
Medium5.3 - CVE-2026-14793
Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization
Craft · CMS
Medium5.3 - CVE-2025-35939
Craft CMS stores user-provided content in session files
Craft · CMS
ExploitedMedium6.9