- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, cms recorded 56 security vulnerabilities in the last 90 days, of which 43 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of cms and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset ReplacementCVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing OracleCVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public RegistrationCVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgCVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityCritical |
|---|
CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | Exploitation statusNot confirmed | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass | Exploitation statusNot confirmed | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | Exploitation statusNot confirmed | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123488Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | Exploitation statusNot confirmed | FixYes | Published11/06/2026 | SeverityCritical |
|---|
CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | Exploitation statusNot exploited | FixYes | Published10/23/2026 | SeverityHigh |
|---|
CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCE | Exploitation statusNot exploited | FixYes | Published10/23/2026 | SeverityHigh |
|---|
CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityCritical |
|---|
CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityLow |
|---|
CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109305Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109304Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-105985Authenticated RCE via render-components Entry Type overrides | Exploitation statusNot exploited | FixYes | Published10/06/2026 | SeverityHigh |
|---|
CVE-2026-92594Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92593Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92592Craft CMS before 4.18.6 Remote Code Execution via signed cookie | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92591Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92590Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-92589Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-79987Low-privilege RCE through element-search eager loading | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-86732Craft CMS before 5.10.12 Remote Code Execution via element-index | Exploitation statusNot exploited | FixYes | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-86731Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController | Exploitation statusNot exploited | FixYes | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-86730Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE | Exploitation statusNot exploited | FixYes | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-84802Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController | Exploitation statusActively exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84801Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84800Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84799Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84798Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84797Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84796Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84795Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityCritical |
|---|
CVE-2026-84794Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84793Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name | Exploitation statusActively exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84792Craft CMS before 5.10.11 Broken Access Control via element-indexes | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-79991Authenticated SQL Injection via nested eager-loading criteria | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-79990GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-79989Arbitrary user password reset leading to administrator account takeover | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
141 Results | Page 1 of 3