Medium
CVE-2025-68437
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 127
Reset filters
Medium
CVE-2025-68436
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Medium
CVE-2025-57811
Craft CMS Potential Remote Code Execution via Twig SSTI
Medium
CVE-2025-54417
Craft CMS has a theoretical bypass for CVE-2025-23209
Medium
Exploited in attacks
CVE-2025-35939
Craft CMS stores arbitrary content provided by unauthenticated users in session files
High
CVE-2025-46731
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Critical
Exploited in attacks
CVE-2025-32432
Craft CMS Allows Remote Code Execution
High
Exploited in attacks
CVE-2025-23209
Craft CMS has a potential RCE with a compromised security key
Critical
Exploited in attacks
CVE-2024-56145
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
High
CVE-2024-52293
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
High
CVE-2024-52292
Craft CMS Arbitrary System File Read
High
CVE-2024-52291
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
Medium
CVE-2024-45406
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
Medium
CVE-2024-41800
Craft CMS Allows TOTP Token To Stay Valid After Use
Critical
CVE-2024-37843
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
High
CVE-2023-36260
Craft CMS Feed-Me
Medium
CVE-2024-21622
Craft CMS Privilege Escalation
Critical
CVE-2023-41892
Craft CMS Remote Code Execution vulnerability
High
CVE-2023-40035
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
Medium
CVE-2023-33495
Craft CMS vulnerable to HTML injection
Medium
CVE-2023-2817
Stored cross site scripting in Craft CMS
Medium
CVE-2023-33197
Craft CMS stored XSS in indexedVolumes
Medium
CVE-2023-33196
Craft CMS stored XSS in review volume
Medium
CVE-2023-33195
Craft CMS XSS in RSS widget feed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.