Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-07 | 1 | Disclosure1 |
| 2026-05-12 | 1 | Disclosure1 |
| 2026-05-13 | 1 | Disclosure1 |
| 2026-06-27 | 1 | General1 |
🟠 Statamic CMS, CSV Formula Injection, #CVE-2026-44306 (Moderate) -DC-Jun2026-722 https://dailycve.com/statamic-cms-csv-formula-injection-cve-2026-44306-moderate-dc-jun2026-722/
Post summary
This brief statement announces the Statamic CMS CSV Formula Injection vulnerability CVE‑2026‑44306, noting a moderate severity, but does not provide PoC, exploit tools, active exploitation evidence, or patch information.
CVE-2026-44306 User Enumeration via Forgot Password Response in Statamic Before 5.73.21 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44306
Post summary
The brief notice discloses CVE-2026-44306 as a user‑enumeration flaw in Statamic before v5.73.21, without providing any PoC, exploit code, or patch information.
CVE-2026-44306 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an acco… https://www.cve.org/CVERecord?id=CVE-2026-44306
Post summary
This post announces CVE-2026-44306, noting that before Statamic versions 5.73.21 and 6.15.0, the forgot‑password feature exposed account existence through its responses.
🟠 Statamic CMS, Email Enumeration, #CVE-2026-44306 (Moderate) https://dailycve.com/statamic-cms-email-enumeration-cve-2026-44306-moderate/
Post summary
A moderate‑severity CVE‑2026‑44306 affecting Statamic CMS allows attackers to enumerate email addresses; no PoC, exploit, or active exploitation evidence is mentioned.