cms

Every one of the 43 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Statamic CMS remote code execution via front-end form uploadsCVE-2023-47129statamic · CVSS 8.4 · 1.4% likely

   CWE-434

2. Remote code execution via form uploads in statamic/cmsCVE-2023-48217statamic · CVSS 8.8 · 1.1% likely

   CWE-94

3. Discoverability of user password hash in Statamic CMSCVE-2022-24784statamic · CVSS 3.7 · 1.0% likely

   CWE-200

4. Statamic account takeover via XSS and password reset linkCVE-2024-24570statamic · CVSS 8.2 · 0.7% likely

   CWE-79

5. Statamic CMS vulnerable to Cross-site Scripting via uploaded assetsCVE-2023-48701statamic · CVSS 7.5 · 0.7% likely

   CWE-79

6. Statamic's Antlers sanitizer cannot effectively sanitize malicious SVGCVE-2023-36828statamic · CVSS 5.5 · 0.7% likely

   CWE-79

7. Statamic CMS has Path Traversal in Asset UploadCVE-2024-52600statamic · CVSS 5.3 · 0.6% likely

   CWE-22

8. Statamic: Account takeover via OAuth email matching without email-verification checkCVE-2026-64665statamic · CVSS 8.1 · 0.5% likely

   CWE-290

9. Statamic is vulnerable to account takeover via password reset link injectionCVE-2026-27593statamic · CVSS 9.3 · 0.5% likely

   CWE-640

10. Statamic vulnerable to remote code execution via Antlers-enabled control panel inputsCVE-2026-28425statamic · CVSS 8 · 0.5% likely

    CWE-94

11. Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionCVE-2026-49287statamic · CVSS 7.4 · 0.5% likely

    CWE-470

12. Statamic Vulnerable to Server-Side Request Forgery via GlideCVE-2026-28423statamic · CVSS 6.8 · 0.4% likely

    CWE-918

13. Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypassCVE-2026-27939statamic · CVSS 8.8 · 0.4% likely

    CWE-287

14. Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesCVE-2026-64662statamic · CVSS 6.5 · 0.4% likely

    CWE-639

15. Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesCVE-2026-71434statamic · CVSS 5.3 · 0.4% likely

    CWE-434

16. Statamic: Unsafe method invocation via Antlers template resolution allows data destructionCVE-2026-64663statamic · CVSS 6.5 · 0.4% likely

    CWE-470

17. Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user VariableCVE-2026-71293statamic · CVSS 6.2 · 0.4% likely

    CWE-200

18. Statamic has a path traversal in file dictionary fieldtypeCVE-2026-33171statamic · CVSS 4.3 · 0.4% likely

    CWE-22

19. Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-64664statamic · CVSS 4.3 · 0.3% likely

    CWE-200

20. Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplateCVE-2026-71435statamic · CVSS 6.1 · 0.3% likely

    CWE-79

21. Statamic: CSV formula injection in form submission exportsCVE-2026-54243statamic · CVSS 6.1 · 0.3% likely

    CWE-1236

22. Statamic has Stored XSS via SVG Sanitization BypassCVE-2026-33172statamic · CVSS 8.7 · 0.3% likely

    CWE-79

23. Statmatic affected by privilege escalation via stored cross-site scriptingCVE-2026-25759statamic · CVSS 8.7 · 0.3% likely

    CWE-79

24. Statamic affected by privilege escalation via stored Cross-site ScriptingCVE-2026-27196statamic · CVSS 8.1 · 0.3% likely

    CWE-79

25. Statamic's missing authorization allows access to assetsCVE-2026-25633statamic · CVSS 4.3 · 0.3% likely

    CWE-862

26. Statmatic vulnerable to Stored Cross-Site ScriptingCVE-2025-64112statamic · CVSS 8 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.