Alchemy-cms

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 4
    Known Exploited: 0
    0
    Critical Level Threats
    1
    High Level Threats
    3
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-57579

    Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

    Last Modified: Sep 15, 2026
    Published: Sep 14, 2026

    CVE-2026-86777

    AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

    Last Modified: Sep 09, 2026
    Published: Sep 09, 2026

    CVE-2026-23885

    AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

    Last Modified: Apr 18, 2026
    Published: Jan 19, 2026

    CVE-2018-18307

    A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."

    Last Modified: Aug 29, 2025
    Published: Oct 16, 2018
    Items Per Page