craftcms vulnerabilities

CVEs per yearBy the year they were published

1. 20239
2. 20247
3. 20255
4. 2026153

Known exploitedNewest addition to KEV first

• CVE-2025-32432

  Craft CMS Allows Remote Code Execution

  craftcms · cms

  ExploitedCritical10.0
• CVE-2024-56145

  RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

  craftcms · cms

  ExploitedCritical9.3
• CVE-2025-23209

  Potential RCE with a compromised security key in craft/cms

  craftcms · cms

  ExploitedHigh8.1

Newest CVEs

• CVE-2026-124431

  Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

  craftcms · cms

  Medium5.3
• CVE-2026-124430

  Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle

  craftcms · cms

  High8.7
• CVE-2026-124429

  Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration

  craftcms · cms

  High8.7
• CVE-2026-124428

  Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

  craftcms · cms

  High7.1
• CVE-2026-124427

  Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

  craftcms · cms

  Critical9.3
• CVE-2026-124426

  Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

  craftcms · cms

  Medium6.9
• CVE-2026-123491

  Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

  craftcms · cms

  High8.8
• CVE-2026-123490

  Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

  craftcms · cms

  High8.7
• CVE-2026-123489

  Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

  craftcms · cms

  High7.1
• CVE-2026-123488

  Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

  craftcms · cms

  Critical9.3