Craft CMS
In 6 briefs, most recently 22 March 2026. RSS for this tag
Learn more: Vulnerabilities (NVD) ↗
Known exploited (CISA KEV)
4 Craft CMS vulnerabilities are on CISA's list of vulnerabilities exploited in the wild. Most recent:
- CVE-2025-32432 Craft CMS Code Injection Vulnerability
- CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
- CVE-2024-56145 Craft CMS Code Injection Vulnerability
- CVE-2025-23209 Craft CMS Code Injection Vulnerability
Coverage in DanSec Daily
- The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
- NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
- Critical WooCommerce Wishlist flaw puts 100k+ WordPress sites at risk; AyySSHush botnet hits 9,000 ASUS routers; Interlock ransomware targets universities.
- Marks & Spencer ransomware disruption by Scattered Spider, SAP NetWeaver CVE-2025-31324 exploitation, and Hitachi Vantara Akira attack.
- The M&S cyberattack, Craft CMS zero-day exploitation and SAP NetWeaver server hijacks, plus the Earth Kurma APT campaign in Southeast Asia.
- Marks & Spencer cyberattack halts online orders, SAP NetWeaver zero-day exploited with web shells, and Craft CMS zero-days hit servers. Plus MTN breach and Salt …