Statamic - vulnerabilities (CVEs)

46 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-06.

Products

• Cms - 43 CVEs
• Statamic - 30 CVEs

Newest CVEs of Statamic

• CVE-2026-71435 - CVSS 6.1 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered…
• CVE-2026-71434 - CVSS 5.3 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload…
• CVE-2026-64662 - CVSS 6.5 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from…
• CVE-2026-64663 - CVSS 6.5 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers…
• CVE-2026-64665 - CVSS 8.1 (high), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not…
• CVE-2026-64664 - CVSS 4.3 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint…
• CVE-2026-71293 - CVSS 6.2 (medium), 2026-08-05: Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's…
• CVE-2026-54243 - CVSS 6.1 (medium), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in…
• CVE-2026-54242 - CVSS 4.9 (medium), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in…
• CVE-2026-54244 - CVSS 3.5 (low), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in…
• CVE-2026-49288 - CVSS 4.3 (medium), 2026-06-19: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata…
• CVE-2026-49287 - CVSS 7.4 (high), 2026-06-19: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed…
• CVE-2026-45660 - CVSS 5.4 (medium), 2026-05-29: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed…
• CVE-2026-44306 - CVSS 5.3 (medium), 2026-05-12: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether…
• CVE-2026-41175 - CVSS 8.1 (high), 2026-04-22: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel…
• CVE-2026-33887 - CVSS 5.4 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry…
• CVE-2026-33883 - CVSS 6.1 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render…
• CVE-2026-33886 - CVSS 6.5 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel…
• CVE-2026-33885 - CVSS 6.1 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect…
• CVE-2026-33884 - CVSS 4.3 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to…
• CVE-2026-33882 - CVSS 6.5 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated…
• CVE-2026-33177 - CVSS 4.3 (medium), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create…
• CVE-2026-33172 - CVSS 8.7 (high), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads…
• CVE-2026-33171 - CVSS 4.3 (medium), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read…
• CVE-2026-32612 - CVSS 5.4 (medium), 2026-03-13: Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows…
• CVE-2026-28423 - CVSS 8.6 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure…
• CVE-2026-28426 - CVSS 8.7 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related…
• CVE-2026-28425 - CVSS 8 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access…
• CVE-2026-28424 - CVSS 6.5 (medium), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses…
• CVE-2026-27939 - CVSS 8.8 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel…