Craftcms Craft Cms vulnerabilities
97 published vulnerabilities in Craftcms Craft Cms, 4 of them exploited in the wild. The most were published in 2026 (35), and 35 so far in 2026.
Craftcms Craft Cms vulnerabilities by year
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Craftcms Craft Cms vulnerabilities
- CVE-2025-32432 Craft CMS Code Injection
- CVE-2024-56145 Craft CMS Code Injection
- CVE-2025-23209 Craft CMS Code Injection
- CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter
- CVE-2023-41892 Craft CMS Remote Code Execution vulnerability
- CVE-2021-27903 Craft CMS Remote Code Injection
- CVE-2020-9757 SEOmatic for CraftCMS allows Server-Side Template Injection
- CVE-2019-15929 Craft CMS possibility of brute force attempts
- CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- CVE-2026-28783 Craft has a Twig Function Blocklist Bypass
- CVE-2023-30130 CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
- CVE-2022-29933 Improper account password reset in Craft CMS
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.