Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: craftcms cms 5.10.13 Clear all filters
TI-2026-62449 CVE-2026-92593 · GHSA-9v9g-4j69-p6q5

Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution

Priority MEDIUM 40

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a se…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00549 Published 2026-09-16 Fixed in 5.10.13 CWE-94
TI-2026-62448 CVE-2026-92592 · GHSA-24f9-r76v-62p8

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Priority MEDIUM 41

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC sig…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00605 Published 2026-09-16 Fixed in 4.18.6, 5.10.13 CWE-1336
TI-2026-62447 CVE-2026-92591 · GHSA-fq6c-26cc-63cr

Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Priority LOW 36

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed productio…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00407 Published 2026-09-16 Fixed in 5.10.13 CWE-636
TI-2026-62446 CVE-2026-92590 · GHSA-gjx7-qh8p-42m8

Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Priority LOW 23

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00235 Published 2026-09-16 Fixed in 5.10.13 CWE-79