Information Disclosure

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal…CVE-2019-14280Craftcms · 9.4% likely

   CWE-200

2. Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQLCVE-2026-92594craftcms · CVSS 7.5 · 0.4% likely

   CWE-200

3. Google Cloud Storage for Craft CMS has an Information Disclosure VulnerabilityCVE-2026-32266craftcms · CVSS 2.4 · 0.4% likely

   CWE-200

4. Amazon S3 for Craft CMS has an Information Disclosure vulnerabilityCVE-2026-32265craftcms · CVSS 6.9 · 0.4% likely

   CWE-200

5. Craft CMS: Sensitive File Disclosure / Server-Side File ReadCVE-2026-55792craftcms · CVSS 6 · 0.3% likely

   CWE-200

6. Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array FiltersCVE-2026-112771craftcms · CVSS 6.5 · 0.3% likely

   CWE-200

7. Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocumentCVE-2026-109304craftcms · CVSS 4.9 · 0.3% likely

   CWE-200

8. Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsCVE-2026-32270craftcms · CVSS 1.7 · 0.3% likely

   CWE-200

9. Craft CMS vulnerable to potential information disclosure via unchecked asset relocationCVE-2025-68436craftcms · CVSS 4.9 · 0.3% likely

   CWE-200

10. Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersCVE-2026-33161craftcms · CVSS 1.3 · 0.2% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.