verbb has 5 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 8.2 (high), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-862 (4). Most affected products: formie (3), verbb/formie (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 1
Weakness classes
Products
- formie 3
- verbb/formie 2
Worst active — by depth score
CVE-2026-52889Critical· 9.8Formie is a Craft CMS plugin for creating forms54CVE-2026-76086High· 8.5Formie is a Craft CMS plugin for creating forms47CVE-2026-76087High· 8.2Formie is a Craft CMS plugin for creating forms45CVE-2026-76089High· 7.7Formie is a Craft CMS plugin for creating forms42GHSA-cvpc-hccg-wmw4Medium· 6.3Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration35
verbb vulnerabilities
CVEs affecting verbb, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-76089High· 7.7Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-s…
CVE-2026-76087High· 8.2Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete subm…
CVE-2026-76086High· 8.5Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration…
CVE-2026-52889Critical· 9.8Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Valu…
GHSA-cvpc-hccg-wmw4Medium· 6.3Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration