Security: statamic/cms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Server-Side Request Forgery via Glide (DNS rebinding)GHSA-v5c4-wcpj-x73m published
Jun 3, 2026 by jasonvargaModerate -
Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesGHSA-2497-6pwj-pwg7 published
May 25, 2026 by jasonvargaModerate -
Unsafe method invocation via collection sorting allows data destructionGHSA-m92m-r54r-x8r2 published
May 25, 2026 by jasonvargaHigh -
Server-Side Request Forgery via GlideGHSA-pf9c-ch8r-2958 published
May 11, 2026 by jasonvargaModerate -
Email enumeration via forgot password endpointGHSA-m24v-f7g5-gq67 published
Apr 28, 2026 by jasonvargaModerate -
Unsafe method invocation via query value resolution allows data destructionGHSA-4jjr-vmv7-wh4w published
Apr 15, 2026 by jasonvargaHigh -
Markdown preview endpoint exposes sensitive user dataGHSA-cvh3-23vq-w7h4 published
Mar 24, 2026 by jasonvargaModerate -
Reflected XSS via unescaped redirect parameter in password reset form tagGHSA-3jg4-p23x-p4qx published
Mar 24, 2026 by jasonvargaModerate -
Live preview token bypasses content protection for unrelated entriesGHSA-8vwx-ccf6-5wg2 published
Mar 24, 2026 by jasonvargaModerate -
Open redirect on unauthenticated endpoints via URL parsing differentialGHSA-7f74-7q5w-hj4r published
Mar 24, 2026 by jasonvargaModerate