CraftCMS cms

• CVE-2026-72782 Medium 6.5 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak 0.4%
• CVE-2026-72781 High 8.8 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape 0.8%
• CVE-2026-72780 Medium 6.5 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey 0.4%
• CVE-2026-72779 Medium 4.5 Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject 0.4%
• CVE-2026-72778 High 8.8 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config 0.8%
• CVE-2026-50282 Medium 4.9 Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves 0.4%
• CVE-2026-50281 High 7.1 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements 0.4%
• CVE-2026-50280 Medium 6.0 Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check 0.4%
• CVE-2026-50279 High 7.6 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap 0.4%
• CVE-2026-55794 High 8.7 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect 0.4%
• CVE-2026-55792 Medium 6.0 Craft CMS: Sensitive File Disclosure / Server-Side File Read 0.3%
• CVE-2026-55791 Medium 6.9 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs 0.5%
• CVE-2026-55790 High 7.4 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget 0.5%
• CVE-2026-50284 High 7.1 Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets 0.4%
• CVE-2026-50283 Medium 5.3 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement 0.4%
• CVE-2026-55793 Medium 5.9 Craft CMS: Stored XSS via Structure entry title in table view 0.3%
• CVE-2026-56394 Medium 6.5 Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter 0.5%
• CVE-2026-56393 Medium 4.8 Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options 0.2%
• CVE-2026-56385 Medium 4.3 Craft CMS - Authorization Bypass in assets/preview-file Endpoint 0.4%
• CVE-2026-56384 Medium 4.3 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint 0.3%
• CVE-2026-56383 Medium 4.8 Craft CMS - Stored XSS in Table Field via Row Heading Column Type 0.2%
• CVE-2026-56382 High 7.2 Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController 0.7%
• CVE-2026-56381 Medium 4.8 Craft CMS - Stored XSS via User Group Name in User Permissions Page 0.2%
• CVE-2026-44011 High 8.6 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior 0.6%
• CVE-2026-44012 High 7.1 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure 0.3%
• CVE-2026-44010 High 7.1 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure 0.4%
• CVE-2026-41130 Medium 5.5 Craft CMS has a host header injection leading to SSRF via resource-js endpoint 0.3%
• CVE-2026-41129 Medium 5.5 Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations 0.3%
• CVE-2026-41128 Medium 5.3 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action 0.2%
• CVE-2026-33162 Medium 4.9 Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions 0.3%
• CVE-2026-33161 Low 1.3 Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users 0.2%
• CVE-2026-33160 Low 2.7 Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL 0.4%
• CVE-2026-33159 Medium 6.9 Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users 0.4%
• CVE-2026-33158 Medium 4.9 Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) 0.4%
• CVE-2026-33157 High 8.6 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior 1.1%
• CVE-2026-33051 Medium 5.3 Craft CMS Vulnerable to Stored XSS in Revision Context Menu 0.3%
• CVE-2026-32267 High 7.7 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() 9.6%
• CVE-2026-32264 High 8.6 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController 0.5%
• CVE-2026-32263 High 8.6 Craft CMS vulnerable to behavior injection RCE via EntryTypesController 0.5%
• CVE-2026-32262 Medium 5.3 Craft CMS has a Path Traversal Vulnerability in AssetsController 0.3%
• CVE-2026-31859 Medium 6.9 Craft has Reflective XSS via incomplete return URL sanitization 0.2%
• CVE-2026-31858 High 8.7 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection 0.4%
• CVE-2026-31857 High 8.1 CraftCMS has an RCE vulnerability via relational conditionals in the control panel 0.9%
• CVE-2026-29113 Low 2.3 Craft has a potential information disclosure vulnerability in preview tokens 0.2%
• CVE-2026-29069 Medium 6.9 Craft has an unauthenticated activation email trigger with potential user enumeration 0.3%
• CVE-2026-28784 High 8.6 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI 0.6%
• CVE-2026-28783 Critical 9.4 Craft has a Twig Function Blocklist Bypass 0.5%
• CVE-2026-28782 Medium 5.3 Craft has a Permission Bypass and IDOR in Duplicate Entry Action 0.3%
• CVE-2026-28781 High 7.1 Craft Affected by Entries Authorship Spoofing via Mass Assignment 0.4%
• CVE-2026-28697 Critical 9.4 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates 1.2%