Information Disclosure

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Discoverability of user password hash in Statamic CMSCVE-2022-24784statamic · CVSS 3.7 · 1.0% likely

   CWE-200

2. Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user VariableCVE-2026-71293statamic · CVSS 6.2 · 0.4% likely

   CWE-200

3. Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-64664statamic · CVSS 4.3 · 0.3% likely

   CWE-200

4. Statamic's Markdown preview endpoint exposes sensitive user dataCVE-2026-33882statamic · CVSS 6.5 · 0.3% likely

   CWE-200

5. Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-49288statamic · CVSS 4.3 · 0.3% likely

   CWE-200

6. Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsCVE-2026-33886statamic · CVSS 6.5 · 0.2% likely

   CWE-200

7. Statamic: Email enumeration via forgot password endpointCVE-2026-44306statamic · CVSS 5.3 · 0.2% likely

   CWE-204

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.