CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/01/2018 |
| CVE-2017-9516 | MEDIUM5.4 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. | 08/06/2017 |
| CVE-2017-8385 | MEDIUM5.3 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. | 01/05/2017 |
| CVE-2017-8384 | MEDIUM6.1 | Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052. | 01/05/2017 |
| CVE-2017-8383 | MEDIUM5.3 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. | 01/05/2017 |
| CVE-2017-8052 | MEDIUM6.1 | Craft CMS before 2.6.2974 allows XSS attacks. | 22/04/2017 |