CVE Tools
Track your stack

Bolt

2 CVEs tracked since 2020. Since Jun 2020, none of them reached CISA KEV.

Bolt CVEs per month

Jun 2020 to Jun 2020. Point at a month, or focus the strip and use the arrow keys.
Bolt CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2020-0620

Products

The products that kept showing up in Bolt's monthly top three, with their CVEs summed over those months.

  1. Bolt21 month

Latest CVEs

The 10 most recently published vulnerabilities affecting Bolt.

  1. CVE-2026-71291Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering8.8
  2. CVE-2026-11511Bolt CMS HTML Attribute TextType.php HTML injection3.5
  3. CVE-2025-34086Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename8.8
  4. CVE-2024-7300Bolt CMS Showcase Creation showcases cross site scripting3.5
  5. CVE-2024-7299Bolt CMS Entry Preview page cross site scripting3.5
  6. CVE-2022-36532Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.8.8
  7. CVE-2021-40219Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code exec...8.8
  8. CVE-2020-4041The filename of uploaded files vulnerable to stored XSS in Bolt CMS7.4
  9. CVE-2020-4040CSRF issue on preview pages in Bolt CMS8.6
  10. CVE-2018-19933Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.6.1

The record

Peak rank
#164 in Jun 2020
Busiest month shown
Jun 2020, 2 CVEs
Months with a KEV entry
0 since Jun 2020
Monthly snapshots
1 since 2020
Bolt's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store