Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: craftcms cms 5.10.12 Clear all filters
TI-2026-59289 CVE-2026-86732 · GHSA-j222-3wjr-f2f7

Craft CMS before 5.10.12 Remote Code Execution via element-index

Priority MEDIUM 41

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0085 Published 2026-09-08 Fixed in 5.10.12 CWE-94
TI-2026-59287 CVE-2026-86730 · GHSA-j4wp-xfvq-c8f7

Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Priority MEDIUM 41

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00707 Published 2026-09-08 Fixed in 5.10.12 CWE-94