Skip to content
OpenAdvisories

Vendor

Craft

3 known vulnerabilities.

Products

CMS 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-14794

    Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

    A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes imp…

    Craft CMS craftcms/cms Packagist
  • Medium 4.3
    CVE-2026-14793

    Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization

    A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be …

    Craft CMS craftcms/cms Packagist
  • Medium 5.3
    CVE-2025-35939 Exploited

    Craft CMS stores user-provided content in session files

    Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and gen…

    Craft CMS craftcms/cms Packagist
    KEV Jun 2, 2025