PatchTheCVEcmc vulnerabilities and fixes
Recent CVEs affecting cmc, with upgrade or downgrade steps. 5 tracked.
cmc has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-05-19. Highest priority: CVE-2025-40904 (score 25/100).
- CVE-2025-40904 MEDIUM 6.5 UPGRADE UPGRADE A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper valida
- CVE-2025-40901 MEDIUM 5.9 UPGRADE UPGRADE A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper
- CVE-2025-40902 MEDIUM 5.9 UPGRADE UPGRADE A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of
- CVE-2025-40903 MEDIUM 5.9 UPGRADE UPGRADE A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to impr
- CVE-2025-40900 MEDIUM 4.6 UPGRADE UPGRADE An Angular template injection vulnerability was discovered in the Reports functionality due to improper valida
FAQ
How do I fix cmc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cmc being exploited right now?
None of the tracked cmc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cmc CVE should I patch first?
CVE-2025-40904 currently ranks highest (25/100): A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper valida.