https://patchfirst.co/vendor/dotcms/New and newly exploited dotCMS CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-8054/CVE-2026-8054Wed, 27 May 2026 00:00:00 GMTdotCMS · dotCMS Core. Not in CISA KEV. EPSS 1.6% (higher than 75.5% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 69.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2025-8311/CVE-2025-8311Thu, 04 Sep 2025 00:00:00 GMTdotCMS · dotCMS Cloud Services (dCS). Not in CISA KEV. EPSS 1.7% (higher than 77.3% of CVEs). CVSS 9.4 CRITICAL. Public exploit code exists. Priority 62.0 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-26352/CVE-2022-26352#kevThu, 25 Aug 2022 00:00:00 GMTdotCMS · dotCMS. In CISA KEV since 2022-08-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 91.2% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1105