octobercms vulnerabilities

41 published CVEs name octobercms among the affected products; CISA lists 1 of them as exploited in the wild.

Critical 1High 8Medium 23Low 9Not scored 0

CVEs per yearBy the year they were published

CVE-2021-32648
Account Takeover in Octobercms
octobercms · october
ExploitedHigh8.2

CVE-2026-49400
October CMS: PHP Object Injection via Backend Widget Session Storage
octobercms · october
Low3.3
CVE-2026-46696
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
octobercms · system
Low3.3
CVE-2026-29179
October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
octobercms · october
Low3.3
CVE-2026-27937
October: Reflected XSS via DataTable Form Widget
octobercms · october
Low3.1
CVE-2026-26274
October: Safe Mode Bypass via Twig Database Write Operations
octobercms · october
Medium6.6
CVE-2026-26067
October: Safe Mode Bypass via CSS Preprocessor Compilers
octobercms · october
Medium4.9
CVE-2026-25133
October CMS has Stored XSS via SVG Filter Bypass
octobercms · october
Medium4.8
CVE-2026-25125
October CMS: Environment Variable Exfiltration via INI Parser Interpolation
octobercms · october
Medium4.9
CVE-2026-24907
October CMS has Stored XSS via Event Log Mail Preview
octobercms · october
Medium5.1
CVE-2026-24906
October CMS has Stored XSS in its Backend Editor Markup Classes
octobercms · october
Medium5.1