mautic has 7 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 7 in the 90 before. The busiest recent month was July 2026 with 7. The median CVSS is 7.1 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 7
Weakness classes
Products
- mautic/core 7
Worst active — by depth score
CVE-2026-9558Critical· 9.9Mautic has Server-Side Template Injection (SSTI) in Theme Templates67CVE-2026-9559Critical· 9.9Mautic vulnerable to Path Traversal via Campaign Import55CVE-2026-9809High· 7.6Mautic has Stored Cross-Site Scripting (XSS) in Projects Component54CVE-2026-9811Medium· 5.4Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector42CVE-2026-9808High· 7.1Mautic has an Authorization Bypass in API v2 Endpoints39
mautic vulnerabilities
CVEs affecting mautic, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-9557Medium· 6.4Mautic Focus component Vulnerable to SSRF
Mautic Focus component Vulnerable to SSRF
CVE-2026-9558Critical· 9.9PoCMautic has Server-Side Template Injection (SSTI) in Theme Templates
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
CVE-2026-9559Critical· 9.9Mautic vulnerable to Path Traversal via Campaign Import
Mautic vulnerable to Path Traversal via Campaign Import
CVE-2026-9808High· 7.1Mautic has an Authorization Bypass in API v2 Endpoints
Mautic has an Authorization Bypass in API v2 Endpoints
CVE-2026-9809High· 7.6PoCMautic has Stored Cross-Site Scripting (XSS) in Projects Component
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
CVE-2026-9811Medium· 5.4PoCMautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
CVE-2026-4776High· 7.1Mautic has SQL Injection in API Contact Filtering
Mautic has SQL Injection in API Contact Filtering