Themeisle Hestia vulnerabilities

2 CVEs affecting Themeisle Hestia, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-53986, published 2025-07-16.

More from Themeisle.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-53986, published 2025-07-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.
• CVE-2024-37467, published 2025-01-02. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Cross-Site Request Forgery (CSRF) vulnerability in themeisle Hestia hestia allows Cross Site Request Forgery.This issue affects Hestia: from n/a through <= 3.1.2.