https://exploit-radar.com/en/flux/categories/cms.xml Exploit Radar: CMS, e-commerce and websites The latest additions to CISA’s catalog of exploited vulnerabilities in the “CMS, e-commerce and websites” category (indicative classification). 2026-09-25T00:00:00Z Exploit Radar https://exploit-radar.com/en/cve/CVE-2026-87902/ CVE-2026-87902 — WordPress Core 2026-09-25T00:00:00Z Apply the patches or mitigations from WordPress; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 25, 2026. https://exploit-radar.com/en/cve/CVE-2026-71362/ CVE-2026-71362 — Adobe Commerce (Magento) 2026-09-24T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 24, 2026. https://exploit-radar.com/en/cve/CVE-2026-75650/ CVE-2026-75650 — Adobe Commerce (Magento) 2026-09-08T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2026. https://exploit-radar.com/en/cve/CVE-2026-63030/ CVE-2026-63030 — WordPress Core 2026-07-21T00:00:00Z Apply the patches or mitigations from WordPress; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 21, 2026. https://exploit-radar.com/en/cve/CVE-2026-60137/ CVE-2026-60137 — WordPress Core 2026-07-21T00:00:00Z Apply the patches or mitigations from WordPress; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on July 21, 2026. https://exploit-radar.com/en/cve/CVE-2026-48939/ CVE-2026-48939 — iCagenda 2026-07-10T00:00:00Z Apply the patches or mitigations from iCagenda; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 10, 2026. https://exploit-radar.com/en/cve/CVE-2026-56291/ CVE-2026-56291 — Balbooa Forms 2026-07-10T00:00:00Z Apply the patches or mitigations from Balbooa; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 10, 2026. https://exploit-radar.com/en/cve/CVE-2026-48908/ CVE-2026-48908 — JoomShaper SP Page Builder 2026-07-07T00:00:00Z Apply the patches or mitigations from JoomShaper; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 7, 2026. https://exploit-radar.com/en/cve/CVE-2026-56290/ CVE-2026-56290 — Joomlack Page Builder 2026-07-07T00:00:00Z Apply the patches or mitigations from Joomlack; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 7, 2026. https://exploit-radar.com/en/cve/CVE-2026-48907/ CVE-2026-48907 — Widget Factory (JCE) JCE (Joomla Content Editor) 2026-06-16T00:00:00Z Apply the patches or mitigations from Widget Factory (JCE); if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on June 16, 2026. https://exploit-radar.com/en/cve/CVE-2026-45247/ CVE-2026-45247 — Mirasvit Full Page Cache Warmer 2026-06-03T00:00:00Z Apply the patches or mitigations from Mirasvit; if none are available, stop using the product. For cloud services, follow the guidance from Mirasvit. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on June 3, 2026. https://exploit-radar.com/en/cve/CVE-2026-9082/ CVE-2026-9082 — Drupal Core 2026-05-22T00:00:00Z Apply the patches or mitigations from Drupal; if none are available, stop using the product. For cloud services, follow the guidance from Drupal. CISA deadline: 5 days. Added to CISA’s catalog of exploited vulnerabilities on May 22, 2026. https://exploit-radar.com/en/cve/CVE-2025-2749/ CVE-2025-2749 — Kentico Xperience 2026-04-20T00:00:00Z Apply the patches or mitigations from Kentico; if none are available, stop using the product. For cloud services, follow the guidance from Kentico. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on April 20, 2026. https://exploit-radar.com/en/cve/CVE-2025-32432/ CVE-2025-32432 — Craft CMS 2026-03-20T00:00:00Z Apply the patches or mitigations from Craft CMS; if none are available, stop using the product. For cloud services, follow the guidance from Craft CMS. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on March 20, 2026. https://exploit-radar.com/en/cve/CVE-2025-54236/ CVE-2025-54236 — Adobe Commerce (Magento) 2025-10-24T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. For cloud services, follow the guidance from Adobe. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 24, 2025. https://exploit-radar.com/en/cve/CVE-2025-2746/ CVE-2025-2746 — Kentico Xperience 2025-10-20T00:00:00Z Apply the patches or mitigations from Kentico; if none are available, stop using the product. For cloud services, follow the guidance from Kentico. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 20, 2025. https://exploit-radar.com/en/cve/CVE-2025-2747/ CVE-2025-2747 — Kentico Xperience 2025-10-20T00:00:00Z Apply the patches or mitigations from Kentico; if none are available, stop using the product. For cloud services, follow the guidance from Kentico. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 20, 2025. https://exploit-radar.com/en/cve/CVE-2025-54253/ CVE-2025-54253 — Adobe Experience Manager (AEM) 2025-10-15T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. For cloud services, follow the guidance from Adobe. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 15, 2025. https://exploit-radar.com/en/cve/CVE-2025-53690/ CVE-2025-53690 — Sitecore Experience Platform / Manager (XP / XM) 2025-09-04T00:00:00Z Apply the patches or mitigations from Sitecore; if none are available, stop using the product. For cloud services, follow the guidance from Sitecore. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 4, 2025. https://exploit-radar.com/en/cve/CVE-2024-56145/ CVE-2024-56145 — Craft CMS 2025-06-02T00:00:00Z Apply the patches or mitigations from Craft CMS; if none are available, stop using the product. For cloud services, follow the guidance from Craft CMS. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on June 2, 2025. https://exploit-radar.com/en/cve/CVE-2025-35939/ CVE-2025-35939 — Craft CMS 2025-06-02T00:00:00Z Apply the patches or mitigations from Craft CMS; if none are available, stop using the product. For cloud services, follow the guidance from Craft CMS. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on June 2, 2025. https://exploit-radar.com/en/cve/CVE-2019-9874/ CVE-2019-9874 — Sitecore Experience Platform / Manager (XP / XM) 2025-03-26T00:00:00Z Apply the patches or mitigations from Sitecore; if none are available, stop using the product. For cloud services, follow the guidance from Sitecore. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 26, 2025. https://exploit-radar.com/en/cve/CVE-2019-9875/ CVE-2019-9875 — Sitecore Experience Platform / Manager (XP / XM) 2025-03-26T00:00:00Z Apply the patches or mitigations from Sitecore; if none are available, stop using the product. For cloud services, follow the guidance from Sitecore. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 26, 2025. https://exploit-radar.com/en/cve/CVE-2025-23209/ CVE-2025-23209 — Craft CMS 2025-02-20T00:00:00Z Apply the patches or mitigations from Craft CMS; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 20, 2025. https://exploit-radar.com/en/cve/CVE-2019-0344/ CVE-2019-0344 — SAP Commerce Cloud (Hybris) 2024-09-30T00:00:00Z Apply the patches or mitigations from SAP; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 30, 2024. https://exploit-radar.com/en/cve/CVE-2024-34102/ CVE-2024-34102 — Adobe Commerce (Magento) 2024-07-17T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on July 17, 2024. https://exploit-radar.com/en/cve/CVE-2023-23752/ CVE-2023-23752 — Joomla! 2024-01-08T00:00:00Z Apply the patches or mitigations from Joomla!; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 8, 2024. https://exploit-radar.com/en/cve/CVE-2022-26352/ CVE-2022-26352 — dotCMS 2022-08-25T00:00:00Z Apply the security update from dotCMS. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2022. https://exploit-radar.com/en/cve/CVE-2018-7602/ CVE-2018-7602 — Drupal Core 2022-04-13T00:00:00Z Apply the security update from Drupal. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on April 13, 2022. https://exploit-radar.com/en/cve/CVE-2019-10068/ CVE-2019-10068 — Kentico Xperience 2022-03-25T00:00:00Z Apply the security update from Kentico. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2021-42237/ CVE-2021-42237 — Sitecore Experience Platform / Manager (XP / XM) 2022-03-25T00:00:00Z Apply the security update from Sitecore. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2019-6340/ CVE-2019-6340 — Drupal Core 2022-03-25T00:00:00Z Apply the security update from Drupal. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2022-24086/ CVE-2022-24086 — Adobe Commerce (Magento) 2022-02-15T00:00:00Z Apply the security update from Adobe. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on February 15, 2022. https://exploit-radar.com/en/cve/CVE-2021-32648/ CVE-2021-32648 — October CMS 2022-01-18T00:00:00Z Apply the security update from October CMS. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on January 18, 2022. https://exploit-radar.com/en/cve/CVE-2020-13671/ CVE-2020-13671 — Drupal Core 2022-01-18T00:00:00Z Apply the security update from Drupal. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on January 18, 2022. https://exploit-radar.com/en/cve/CVE-2020-17463/ CVE-2020-17463 — Fuel CMS 2021-12-10T00:00:00Z Apply the security update from Fuel CMS. CISA deadline: 182 days. Added to CISA’s catalog of exploited vulnerabilities on December 10, 2021. https://exploit-radar.com/en/cve/CVE-2018-7600/ CVE-2018-7600 — Drupal Core 2021-11-03T00:00:00Z Apply the security update from Drupal. CISA deadline: 181 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2019-16759/ CVE-2019-16759 — vBulletin 2021-11-03T00:00:00Z Apply the security update from vBulletin. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2020-17496/ CVE-2020-17496 — vBulletin 2021-11-03T00:00:00Z Apply the security update from vBulletin. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2020-25213/ CVE-2020-25213 — WordPress Plugins 2021-11-03T00:00:00Z Apply the security update from WordPress. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2020-7961/ CVE-2020-7961 — Liferay Portal / DXP 2021-11-03T00:00:00Z Apply the security update from Liferay. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2017-9822/ CVE-2017-9822 — DotNetNuke (DNN) 2021-11-03T00:00:00Z Apply the security update from DotNetNuke (DNN). CISA deadline: 181 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2018-15811/ CVE-2018-15811 — DotNetNuke (DNN) 2021-11-03T00:00:00Z Apply the security update from DotNetNuke (DNN). CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2018-18325/ CVE-2018-18325 — DotNetNuke (DNN) 2021-11-03T00:00:00Z Apply the security update from DotNetNuke (DNN). CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2020-11738/ CVE-2020-11738 — WordPress Plugins 2021-11-03T00:00:00Z Apply the security update from WordPress. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2019-9978/ CVE-2019-9978 — WordPress Plugins 2021-11-03T00:00:00Z Apply the security update from WordPress. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021.