What’s Vulnerable › Products

octobercms october vulnerabilities

62 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your octobercms october version is affected

Exploited octobercms october vulnerabilities

• CVE-2021-32648 — October CMS Improper Authentication

Latest octobercms october vulnerabilities

• CVE-2026-49400 — October CMS: PHP Object Injection via Backend Widget Session Storage (CVSS 3.3)
• CVE-2026-29179 — October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations (CVSS 3.3)
• CVE-2026-27937 — October: Reflected XSS via DataTable Form Widget (CVSS 3.1)
• CVE-2026-26274 — October: Safe Mode Bypass via Twig Database Write Operations (CVSS 6.6)
• CVE-2026-26067 — October: Safe Mode Bypass via CSS Preprocessor Compilers (CVSS 4.9)
• CVE-2026-25133 — October CMS has Stored XSS via SVG Filter Bypass (CVSS 4.8)
• CVE-2026-25125 — October CMS: Environment Variable Exfiltration via INI Parser Interpolation (CVSS 4.9)
• CVE-2026-24907 — October CMS has Stored XSS via Event Log Mail Preview (CVSS 5.4)
• CVE-2026-24906 — October CMS has Stored XSS in its Backend Editor Markup Classes (CVSS 5.4)
• CVE-2026-22692 — October CMS: Twig Sandbox Bypass via Collection Methods (CVSS 6.8)
• CVE-2025-61676 — October CMS Vulnerable to Stored XSS via Branding Styles (CVSS 4.8)
• CVE-2025-61674 — October CMS Vulnerable to Stored XSS via Editor and Branding Styles (CVSS 4.8)
• CVE-2024-51991 — October CMS Allows Unprotected SVG Rename in Media Manager (CVSS 4.9)
• CVE-2024-45962 — (CVSS 4.7)
• CVE-2024-25837 — (CVSS 5.4)
• CVE-2024-25637 — Reflected XSS via X-October-Request-Handler Header (CVSS 5.4)
• CVE-2024-24764 — October Open Redirect for Administrator Accounts (CVSS 4.8)
• CVE-2023-25365 — (CVSS 7.8)
• CVE-2023-44382 — October CMS safe mode bypass using Twig sandbox escape (CVSS 9.1)
• CVE-2023-44381 — October CMS safe mode bypass using Page template injection (CVSS 4.9)
• CVE-2023-44383 — October CMS stored XSS by authenticated backend user with improper configuration (CVSS 5.4)
• CVE-2023-43876 — (CVSS 5.4)
• CVE-2023-37692 — (CVSS 5.4)
• CVE-2022-35944 — October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) (CVSS 7.2)
• CVE-2022-24800 — Race Condition in October CMS upload process (CVSS 8.1)