Vendor
Craft CMS
As of , 4 Craft CMS vulnerabilities are on CISA's list of exploited vulnerabilities; 1 was added in 2026. Patch first: CVE-2025-32432.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-32432Code Injection | Craft CMS Craft CMS | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 2 | CVE-2024-56145Code Injection | Craft CMS Craft CMS | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| 3 | CVE-2025-23209Code Injection | Craft CMS Craft CMS | Patch soon | 0.22 | ||
| 4 | CVE-2025-35939External Control of Assumed-Immutable Web Parameter | Craft CMS Craft CMS | Patch soon | 0.01 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2025 | 3 |
| 2026 | 1 |