CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,438 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,438
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wintercms:winter. Show all products

11 CVEs, showing 1 to 11
CVESeverityTitlePublished
CVE-2026-63179Medium 4.9Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-54256Medium 5.4Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-32639Medium 6.8Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-32593Medium 5.9Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-32258High 8.1Winter: Stored XSS through Editor Settings custom styles
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-32257High 8.1Winter: Stored XSS through Brand Settings custom styles
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-35445High 7.1Winter: Authenticated backend users can bypass Users controller permission checks
Assigned by GitHub_M
Aug 26, 2026
CVE-2026-79774High 8.4Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79773Medium 4.9Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-27591Critical 9.9Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.Mar 11, 2026
CVE-2026-22254Low 3.5Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.Feb 6, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.