ZeusQA
Start free

Known exploited vulnerabilities

Craft CMS vulnerabilities attackers have used

Every Craft CMS vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 4 Craft CMS vulnerabilities as exploited in the wild, 1 of them added in the last 12 months. The most recent is CVE-2025-32432, added Mar 20, 2026. Craft CMS has the most entries (4).

In KEV, all time
4
Added, last 12 months
1
Used in ransomware
0
New CVEs this week
0

Every Craft CMS entry in CISA KEV

  1. CVE-2025-32432

    Added · due

    Craft CMS Code Injection Vulnerability

    Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

  2. CVE-2025-35939

    Added · due

    Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

    Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the…

  3. CVE-2024-56145

    Added · due

    Craft CMS Code Injection Vulnerability

    Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.

  4. CVE-2025-23209

    Added · due

    Craft CMS Code Injection Vulnerability

    Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works