statamic vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20234
3. 20243
4. 20251
5. 202634

Newest CVEs

• CVE-2026-71435

  Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

  statamic · cms

  Medium6.1
• CVE-2026-71434

  Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

  statamic · cms

  Medium5.3
• CVE-2026-64662

  Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

  statamic · cms

  Medium6.5
• CVE-2026-64663

  Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

  statamic · cms

  Medium6.5
• CVE-2026-64665

  Statamic: Account takeover via OAuth email matching without email-verification check

  statamic · cms

  High8.1
• CVE-2026-64664

  Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

  statamic · cms

  Medium4.3
• CVE-2026-71293

  Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

  statamic · cms

  Medium6.2
• CVE-2026-54243

  Statamic: CSV formula injection in form submission exports

  statamic · cms

  Medium6.1
• CVE-2026-54242

  Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

  statamic · cms

  Medium4.9
• CVE-2026-54244

  Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors

  statamic · cms

  Low3.5