CVE-2026-92594 | High | 7.5 | 2026-09-16 | Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-dat… |
CVE-2026-92593 | High | 8.8 | 2026-09-16 | Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate()… |
CVE-2026-92592 | High | 8.8 | 2026-09-16 | Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used… |
CVE-2026-92591 | Medium | 5.9 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — includin… |
CVE-2026-92590 | Medium | 5.4 | 2026-09-16 | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescapin… |
CVE-2026-92589 | Medium | 4.3 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control… |
CVE-2026-55795 | | | 2026-09-14 | Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its Ra… |
CVE-2026-79987 | High | 8.8 | 2026-09-10 | A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker. |
CVE-2026-86732 | High | 8.8 | 2026-09-08 | Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to inst… |
CVE-2026-86731 | Medium | 6.5 | 2026-09-08 | Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While t… |
CVE-2026-86730 | High | 8.8 | 2026-09-08 | Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavi… |
CVE-2026-79991 | | | 2026-09-02 | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments()… |
CVE-2026-79990 | | | 2026-09-02 | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments()… |
CVE-2026-79989 | | | 2026-09-02 | The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It al… |
CVE-2026-84802 | Medium | 4.3 | 2026-09-02 | Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume p… |
CVE-2026-84801 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers perm… |
CVE-2026-84800 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sou… |
CVE-2026-84799 | Medium | 4.3 | 2026-09-02 | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revis… |
CVE-2026-84798 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads… |
CVE-2026-84797 | Medium | 6.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with c… |
CVE-2026-84796 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentMa… |
CVE-2026-84795 | Critical | 9.8 | 2026-09-02 | Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can regis… |
CVE-2026-84794 | High | 7.1 | 2026-09-02 | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset… |
CVE-2026-84793 | Medium | 4.8 | 2026-09-02 | Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Admin… |
CVE-2026-84792 | Medium | 4.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users t… |
CVE-2026-79988 | | | 2026-08-27 | The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previous… |
CVE-2026-78416 | | | 2026-08-24 | Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel… |
CVE-2026-72787 | Medium | 6.4 | 2026-08-12 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding… |
CVE-2026-72786 | Medium | 6.5 | 2026-08-12 | Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords… |
CVE-2026-72785 | Medium | 4.3 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without… |
CVE-2026-72784 | Medium | 5.4 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Ass… |
CVE-2026-72783 | Medium | 6.2 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained functio… |
CVE-2026-72782 | Medium | 6.5 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the eleme… |
CVE-2026-72781 | High | 8.8 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Becau… |
CVE-2026-72780 | Medium | 6.5 | 2026-08-11 | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay ca… |
CVE-2026-72779 | Medium | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instanti… |
CVE-2026-72778 | High | 8.8 | 2026-08-11 | Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control pa… |
CVE-2026-50282 | | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an auth… |
CVE-2026-50281 | | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action… |
CVE-2026-55794 | | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute u… |
CVE-2026-55792 | | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl(… |
CVE-2026-55791 | | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… |
CVE-2026-50280 | | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates th… |
CVE-2026-50279 | | | 2026-07-02 | Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit pe… |
CVE-2026-55790 | | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can… |
CVE-2026-50284 | | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() o… |
CVE-2026-50283 | | | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsCo… |
CVE-2026-55793 | | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript paylo… |
CVE-2026-56394 | Medium | 6.5 | 2026-06-21 | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated befo… |
CVE-2026-56393 | Medium | 4.8 | 2026-06-21 | Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where setting… |
CVE-2026-56385 | Medium | 4.3 | 2026-06-21 | Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not… |
CVE-2026-56384 | Medium | 4.3 | 2026-06-21 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private… |
CVE-2026-56383 | Medium | 4.8 | 2026-06-21 | Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The applicat… |
CVE-2026-56382 | High | 7.2 | 2026-06-21 | Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCa… |
CVE-2026-56381 | Medium | 4.8 | 2026-06-21 | Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without… |
CVE-2026-44012 | | | 2026-05-12 | Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its… |
CVE-2026-44011 | | | 2026-05-12 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creati… |
CVE-2026-44010 | | | 2026-05-12 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Addre… |
CVE-2026-41130 | | | 2026-04-22 | Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the `resource-js` endpoint in C… |
CVE-2026-41129 | | | 2026-04-22 | Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Reque… |
CVE-2026-41128 | | | 2026-04-22 | Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` pe… |
CVE-2026-32272 | | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVarian… |
CVE-2026-32271 | | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the… |
CVE-2026-32270 | | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses so… |
CVE-2026-33162 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move en… |
CVE-2026-33161 | Medium | 4.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33160 | Medium | 5.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthe… |
CVE-2026-33159 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest user… |
CVE-2026-33158 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33157 | High | 7.2 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, i… |
CVE-2026-33051 | Medium | 5.4 | 2026-03-20 | Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the crea… |
CVE-2026-32268 | | | 2026-03-18 | The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthentic… |
CVE-2026-32266 | | | 2026-03-18 | The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `Def… |
CVE-2026-32265 | | | 2026-03-18 | The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of b… |
CVE-2026-32267 | Critical | 9.8 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-priv… |
CVE-2026-32264 | High | 7.2 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a… |
CVE-2026-32263 | High | 7.2 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array f… |
CVE-2026-32262 | Medium | 4.3 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the Assets… |
CVE-2026-32261 | | | 2026-03-16 | Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version… |
CVE-2026-31867 | Medium | 4.8 | 2026-03-11 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Comm… |
CVE-2026-31859 | Medium | 6.1 | 2026-03-11 | Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return UR… |
CVE-2026-31858 | High | 8.8 | 2026-03-11 | Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was added to ElementInd… |
CVE-2026-31857 | High | 8.8 | 2026-03-11 | Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The B… |
CVE-2026-29177 | Medium | 5.4 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerc… |
CVE-2026-29176 | Medium | 4.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. T… |
CVE-2026-29175 | Medium | 5.4 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Vari… |
CVE-2026-29174 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoin… |
CVE-2026-29173 | Medium | 4.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Statu… |
CVE-2026-29172 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpo… |
CVE-2026-29113 | Medium | 4.3 | 2026-03-10 | Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-toke… |
CVE-2026-29069 | Medium | 5.3 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated… |
CVE-2026-28784 | High | 7.2 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields t… |
CVE-2026-28783 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP func… |
CVE-2026-28782 | Medium | 4.3 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has perm… |
CVE-2026-28781 | Medium | 6.5 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attr… |
CVE-2026-28697 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by… |
CVE-2026-28696 | High | 7.5 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tag… |
CVE-2026-28695 | High | 7.2 | 2026-03-04 | Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig… |
CVE-2026-27129 | Medium | 6.5 | 2026-02-24 | Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asse… |
CVE-2026-27128 | Medium | 4.8 | 2026-02-24 | Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condi… |