craftcms vulnerabilities

CVEs per yearBy the year they were published

1. 20239
2. 20247
3. 20255
4. 2026143

Known exploitedNewest addition to KEV first

• CVE-2025-32432

  Craft CMS Allows Remote Code Execution

  craftcms · cms

  ExploitedCritical10.0
• CVE-2024-56145

  RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

  craftcms · cms

  ExploitedCritical9.3
• CVE-2025-23209

  Potential RCE with a compromised security key in craft/cms

  craftcms · cms

  ExploitedHigh8.1

Newest CVEs

• CVE-2026-115938

  Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

  craftcms · cms

  High8.7
• CVE-2026-115937

  Unauthenticated payment reuse allows unpaid orders to be marked as paid

  craftcms · commerce-mollie

  High8.7
• CVE-2026-115935

  Control panel only API response emulation replaces "securityKey" and reaches server RCE

  craftcms · cms

  High8.7
• CVE-2026-112777

  Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

  craftcms · cms

  High8.7
• CVE-2026-112776

  Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

  craftcms · cms

  Critical9.3
• CVE-2026-112775

  Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password

  craftcms · cms

  High8.7
• CVE-2026-112774

  Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

  craftcms · cms

  High8.7
• CVE-2026-112773

  Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

  craftcms · cms

  High8.7
• CVE-2026-112772

  Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

  craftcms · cms

  High8.7
• CVE-2026-112771

  Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

  craftcms · cms

  High7.1