Craftcms / Cms
121 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-92594 | Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL | HIGH | 8.7 | Sep 16, 2026 |
| CVE-2026-92593 | Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution | HIGH | 8.7 | Sep 16, 2026 |
| CVE-2026-92592 | Craft CMS before 4.18.6 Remote Code Execution via signed cookie | HIGH | 8.7 | Sep 16, 2026 |
| CVE-2026-92591 | Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer | HIGH | 8.2 | Sep 16, 2026 |
| CVE-2026-92590 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields | MEDIUM | 5.1 | Sep 16, 2026 |
| CVE-2026-92589 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder | MEDIUM | 5.3 | Sep 16, 2026 |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | HIGH | 8.7 | Sep 10, 2026 |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | HIGH | 8.7 | Sep 8, 2026 |
| CVE-2026-86731 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController | HIGH | 7.1 | Sep 8, 2026 |
| CVE-2026-86730 | Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE | HIGH | 8.7 | Sep 8, 2026 |
| CVE-2026-79991 | Authenticated SQL Injection via nested eager-loading criteria | HIGH | 7.1 | Sep 2, 2026 |
| CVE-2026-79990 | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete | HIGH | 8.7 | Sep 2, 2026 |
| CVE-2026-79989 | Arbitrary user password reset leading to administrator account takeover | HIGH | 8.7 | Sep 2, 2026 |
| CVE-2026-84802 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController | MEDIUM | 5.3 | Sep 2, 2026 |
| CVE-2026-84801 | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers | HIGH | 8.7 | Sep 2, 2026 |
| CVE-2026-84800 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file | HIGH | 7.1 | Sep 2, 2026 |
| CVE-2026-84799 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations | MEDIUM | 5.3 | Sep 2, 2026 |
| CVE-2026-84798 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite | HIGH | 7.1 | Sep 2, 2026 |
| CVE-2026-84797 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate | MEDIUM | 5.3 | Sep 2, 2026 |
| CVE-2026-84796 | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass | HIGH | 8.7 | Sep 2, 2026 |
| CVE-2026-84795 | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance | CRITICAL | 9.2 | Sep 2, 2026 |
| CVE-2026-84794 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset | HIGH | 7.1 | Sep 2, 2026 |
| CVE-2026-84793 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name | MEDIUM | 4.8 | Sep 2, 2026 |
| CVE-2026-84792 | Craft CMS before 5.10.11 Broken Access Control via element-indexes | MEDIUM | 5.3 | Sep 2, 2026 |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | HIGH | 8.7 | Aug 27, 2026 |
Showing 1 to 25 of 121 CVEs