Vendor
Craft vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 51 vulnerabilities in Craft: 9 in the last 7 days and 43 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115934, was published on 9 November 2026. 21 vulnerabilities in the last four weeks, up 200% on the four before (7). 2 critical against 0. 1 technology has a page of its own.
- Last 7 days
- 9
- Last 90 days
- 43
- Critical, all time
- 4
- Exploited in the wild
- 0
About Craft
Craft is a content management system and platform for building digital experiences.
Craft technologies
Latest Craft vulnerabilities
- CVE-2026-115934: Craft CMS SQL injection in craft.searchcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-124431: Craft CMS authorization bypass in volume browsermediumCVSS 4.3
- CVE-2026-124429: Craft CMS privilege escalation in public registrationhighCVSS 7.5
- CVE-2026-124428: Craft CMS path traversal in app/icon-svg endpointmediumCVSS 6.5
- CVE-2026-124427: Craft CMS authorization bypass in GraphQL schema scopecriticalCVSS 9.8
- CVE-2026-124426: Craft CMS authorization bypass in GraphQL localized fieldmediumCVSS 5.3
- CVE-2026-123491: Craft CMS SQL injection in GraphQL eager-loadinghighCVSS 8.2
- CVE-2026-123490: Craft CMS privilege escalation via getOwners() sandbox bypasshighCVSS 8.8
- CVE-2026-123488: Craft CMS SQL injection in element search endpointcriticalCVSS 9.8
- CVE-2026-115938: Craft CMS template injection in element searchhighCVSS 8.8
- CVE-2026-115937: Craft Commerce Mollie webhook parameter validation bypasshighCVSS 7.5
- CVE-2026-115935: Craft CMS privilege escalation via API response header injectionhighCVSS 8.8
- CVE-2026-112777: Craft CMS blocklist bypass in Twig create() functionhighCVSS 7.2
- CVE-2026-112775: Craft CMS verification code reuse allows account takeoverhighCVSS 7.5
- CVE-2026-112774: Craft CMS authenticated admin RCE via ContentBlock field-layouthighCVSS 7.2
- CVE-2026-112773: Craft CMS Twig sandbox escape and remote code executionhighCVSS 8.8
- CVE-2026-112771: Craft CMS Twig sandbox allowlist bypass via array filtersmediumCVSS 6.5
- CVE-2026-112770: Craft CMS Twig group filter remote code executionhighCVSS 8.8
- CVE-2026-109308: Craft CMS behavior injection RCE in AppController::actionCacheUpdateshighCVSS 8.8EPSS 0.5%
- CVE-2026-109307: Craft CMS DOM-based cross-site scripting in 2FA verificationmediumCVSS 4.7EPSS 0.2%
- CVE-2026-109305: Craft CMS Twig sandbox bypass in "has some"/"has every" operatorshighCVSS 8.8EPSS 0.5%
- CVE-2026-109304: Craft CMS arbitrary file read via Twig create() DOMDocumentmediumCVSS 4.9EPSS 0.3%
- CVE-2026-105985: Craft CMS authenticated remote code execution in Control PanelhighCVSS 8.8
- CVE-2026-92594: Craft CMS GraphQL authorization bypass in draftCreator and revisionCreator fieldshighCVSS 7.5EPSS 0.4%
- CVE-2026-92593: Craft CMS authenticated server-side template injectionhighCVSS 8.8EPSS 0.5%
Most severe Craft vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-84795: Craft CMS privilege escalation via admin flag inheritance in user registrationcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-115934: Craft CMS SQL injection in craft.searchcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-124427: Craft CMS authorization bypass in GraphQL schema scopecriticalCVSS 9.8
- CVE-2026-123488: Craft CMS SQL injection in element search endpointcriticalCVSS 9.8
- CVE-2026-72778: Craft CMS authenticated remote code execution in element-search conditionhighCVSS 8.8EPSS 0.8%
- CVE-2026-72781: Craft CMS remote code execution via Twig sandbox escapehighCVSS 8.8EPSS 0.8%
- CVE-2026-86730: Craft CMS behavior injection in field-layout elementshighCVSS 8.8EPSS 0.7%
- CVE-2026-92592: Craft CMS authenticated remote code execution via signed-cookie confusionhighCVSS 8.8EPSS 0.7%
- CVE-2026-92593: Craft CMS authenticated server-side template injectionhighCVSS 8.8EPSS 0.5%
- CVE-2026-109308: Craft CMS behavior injection RCE in AppController::actionCacheUpdateshighCVSS 8.8EPSS 0.5%
Vulnerabilities per week
21 vulnerabilities in the last four weeks, up 200% on the four before (7). 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 10 | 1 | |
| 7 Sep 2026 | 2 | 0 | |
| 14 Sep 2026 | 6 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 9 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 8 | 2 | |
| 9 Nov 2026 | 1 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Craft vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/craft)<a href="https://junglewise.ai/threats/vendors/craft"><img src="https://junglewise.ai/threats/vendors/craft/badge.svg" alt="Craft vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/craft.json, and this page as text at https://junglewise.ai/threats/vendors/craft.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Craft vulnerabilities", https://junglewise.ai/threats/vendors/craft, 12 November 2026.