MEDIUM6.1Packagist
GHSA-55mm-5399-7r63· CVE-2020-15128Reliance on Cookies without validation in OctoberCMS
Modified: 9/10/2026
package
Packagist/october/rain
pkg:packagist/october/rain
CRITICAL9.8Packagist
GHSA-7ggw-h8pp-r95r· CVE-2021-3311October CMS Session ID not invalidated after logout
Modified: 2/16/2024
MEDIUM4.9Packagist
GHSA-g6v3-wv4j-x9hg· CVE-2026-25125October Rain has Environment Variable Exfiltration via INI Parser Interpolation
Modified: 5/8/2026
MEDIUM4.8Packagist
GHSA-gcqv-f29m-67gr· CVE-2026-25133October Rain has Stored XSS via SVG Filter Bypass
Modified: 5/8/2026
MEDIUM5.4Packagist
GHSA-gvgf-fp4m-2hw6· CVE-2017-15284OctoberCMS Cross-Site Scripting
Modified: 4/23/2025
MEDIUM4.9Packagist
GHSA-m5qg-jc75-4jp6· CVE-2026-22692October Rain has a Twig Sandbox Bypass via Collection Methods
Modified: 4/14/2026