CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/01/2018 |
| CVE-2017-9516 | 中危5.4 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. | 08/06/2017 |
| CVE-2017-8385 | 中危5.3 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. | 01/05/2017 |
| CVE-2017-8384 | 中危6.1 | Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052. | 01/05/2017 |
| CVE-2017-8383 | 中危5.3 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. | 01/05/2017 |
| CVE-2017-8052 | 中危6.1 | Craft CMS before 2.6.2974 allows XSS attacks. | 22/04/2017 |