# Mautic vulnerabilities Source: https://junglewise.ai/threats/technologies/mautic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mautic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Mautic: 0 in the last 7 days and 7 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115196, was published on 26 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 7 - All time: 13 (2 critical, 0 exploited in the wild) ## About Mautic Mautic is an open-source marketing automation platform that provides tools for lead tracking, email marketing, and campaign management. ## Latest Mautic vulnerabilities - [CVE-2026-115196: Mautic open redirect in form submission endpoint](https://junglewise.ai/threats/cve-2026-115196-an-open-redirect-vulnerability-exists-in-the-public-form) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-115195: Mautic Stats API broken access control in permission enforcement](https://junglewise.ai/threats/cve-2026-115195-a-broken-access-control-vulnerability-exists-in-the-mautic-stats) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115193: Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-115192: Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115191: Mautic SQL injection in contact lookup AJAX endpoint](https://junglewise.ai/threats/cve-2026-115191-a-sql-injection-vulnerability-exists-in-a-contact-lookup-ajax) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115190: Mautic insecure deserialization in segment filters and custom fields](https://junglewise.ai/threats/cve-2026-115190-an-insecure-deserialization-php-object-injection-vulnerability) (high, CVSS 8, published 26 Oct 2026) - [CVE-2026-115188: Mautic unrestricted file upload in campaign import](https://junglewise.ai/threats/cve-2026-115188-an-unrestricted-file-upload-vulnerability-exists-in-the-campaign) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-9811: Mautic stored XSS in project selector component](https://junglewise.ai/threats/cve-2026-9811-mautic-stored-xss-in-project-selector-component) (medium, CVSS 5.4, published 29 May 2026) - [CVE-2026-9809: Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags) (high, CVSS 7.6, published 29 May 2026) - [CVE-2026-9558: Mautic Server-Side Template Injection in theme engine](https://junglewise.ai/threats/cve-2026-9558-mautic-server-side-template-injection-in-theme-engine) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-9557: Mautic Focus component Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-9557-mautic-focus-component-server-side-request-forgery) (medium, CVSS 6.4, published 29 May 2026) - [CVE-2026-4776: Mautic SQL injection in API contact filtering](https://junglewise.ai/threats/cve-2026-4776-mautic-sql-injection-in-api-contact-filtering) (high, CVSS 7.1, published 29 May 2026) - [CVE-2025-13828: Mautic privilege escalation via unauthorized composer package installation](https://junglewise.ai/threats/cve-2025-13828-mautic-privilege-escalation-via-unauthorized-composer-package) (medium, CVSS 4, published 2 Dec 2025) ## Most severe Mautic vulnerabilities - [CVE-2026-9558: Mautic Server-Side Template Injection in theme engine](https://junglewise.ai/threats/cve-2026-9558-mautic-server-side-template-injection-in-theme-engine) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-115188: Mautic unrestricted file upload in campaign import](https://junglewise.ai/threats/cve-2026-115188-an-unrestricted-file-upload-vulnerability-exists-in-the-campaign) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-115193: Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-115190: Mautic insecure deserialization in segment filters and custom fields](https://junglewise.ai/threats/cve-2026-115190-an-insecure-deserialization-php-object-injection-vulnerability) (high, CVSS 8, published 26 Oct 2026) - [CVE-2026-9809: Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags) (high, CVSS 7.6, published 29 May 2026) - [CVE-2026-4776: Mautic SQL injection in API contact filtering](https://junglewise.ai/threats/cve-2026-4776-mautic-sql-injection-in-api-contact-filtering) (high, CVSS 7.1, published 29 May 2026) - [CVE-2026-115192: Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115191: Mautic SQL injection in contact lookup AJAX endpoint](https://junglewise.ai/threats/cve-2026-115191-a-sql-injection-vulnerability-exists-in-a-contact-lookup-ajax) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115195: Mautic Stats API broken access control in permission enforcement](https://junglewise.ai/threats/cve-2026-115195-a-broken-access-control-vulnerability-exists-in-the-mautic-stats) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-9557: Mautic Focus component Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-9557-mautic-focus-component-server-side-request-forgery) (medium, CVSS 6.4, published 29 May 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 7 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Mautic technologies - [Mautic Core](https://junglewise.ai/threats/technologies/mautic-core): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mautic vulnerabilities", https://junglewise.ai/threats/technologies/mautic, 9 November 2026.