CVE-2026-71435 | Medium | 6.1 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered u… |
CVE-2026-71434 | Medium | 5.3 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restri… |
CVE-2026-64665 | High | 8.1 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not g… |
CVE-2026-64664 | Medium | 4.3 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint in… |
CVE-2026-64663 | Medium | 6.5 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers t… |
CVE-2026-64662 | Medium | 6.5 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from… |
CVE-2026-71293 | Medium | 6.2 | 2026-08-05 | Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's r… |
CVE-2026-54244 | Low | 3.5 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in… |
CVE-2026-54243 | Medium | 6.1 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.p… |
CVE-2026-54242 | Medium | 4.9 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/Remot… |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-49287 | High | 7.4 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the… |
CVE-2026-45660 | Medium | 5.4 | 2026-05-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed us… |
CVE-2026-44306 | Medium | 5.3 | 2026-05-12 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether… |
CVE-2026-41175 | High | 8.1 | 2026-04-22 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and… |
CVE-2026-33887 | Medium | 5.4 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry… |
CVE-2026-33886 | Medium | 6.5 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user… |
CVE-2026-33885 | Medium | 6.1 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect valida… |
CVE-2026-33884 | Medium | 4.3 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to… |
CVE-2026-33883 | Medium | 6.1 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render use… |
CVE-2026-33882 | Medium | 6.5 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated… |
CVE-2026-33177 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create tax… |
CVE-2026-33172 | High | 8.7 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads a… |
CVE-2026-33171 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitr… |
CVE-2026-32612 | Medium | 5.4 | 2026-03-13 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticat… |
CVE-2026-28426 | High | 8.7 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related c… |
CVE-2026-28425 | High | 8.0 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to… |
CVE-2026-28424 | Medium | 6.5 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses fr… |
CVE-2026-28423 | Medium | 6.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure… |
CVE-2026-27939 | High | 8.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users… |
CVE-2026-27593 | Critical | 9.3 | 2026-02-24 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the pa… |
CVE-2026-27196 | High | 8.1 | 2026-02-21 | Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS… |
CVE-2026-25759 | High | 8.7 | 2026-02-11 | Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authent… |
CVE-2026-25633 | Medium | 4.3 | 2026-02-11 | Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able t… |
CVE-2025-64112 | High | 8.0 | 2025-10-30 | Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with… |
CVE-2024-52600 | Medium | 5.3 | 2024-11-19 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may resul… |
CVE-2024-36119 | Low | 1.8 | 2024-05-30 | Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have thei… |
CVE-2024-24570 | High | 8.2 | 2024-02-01 | Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end form… |
CVE-2023-48701 | High | 7.5 | 2023-11-21 | Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be up… |
CVE-2023-48217 | High | 8.8 | 2023-11-14 | Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like imag… |
CVE-2023-47129 | High | 8.3 | 2023-11-10 | Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP f… |
CVE-2023-36828 | Medium | 5.5 | 2023-07-05 | Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, a… |
CVE-2022-24784 | Low | 3.7 | 2022-03-25 | Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a spe… |
CVE-2021-45364 | Critical | 9.8 | 2022-02-10 | A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publ… |
CVE-2018-19598 | Medium | 4.8 | 2018-12-19 | Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request. |
CVE-2017-11422 | High | 8.8 | 2017-07-24 | Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include r… |