[CRITICAL] Craft CMS: Passkey login accepts replayed WebAuthn assertions

PKSA-jk69-ryht-534b GHSA-wg23-69c2-gjc8

Affected version: >=5.0.0-RC1,<5.10.5

Reported by:
GitHub

[MEDIUM] Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

PKSA-19kf-75v5-vy76 CVE-2026-72779 GHSA-957r-qf9p-67xw

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authenticated leak of secret environment variables

PKSA-4q3g-gxhk-813s CVE-2026-72782 GHSA-596p-6jv8-775v

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

PKSA-gh5w-x99g-b53n CVE-2026-72785 GHSA-xxpx-f366-4xpq

Affected version: >=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

PKSA-1412-5vdy-cd6w CVE-2026-14794 GHSA-rvmm-v933-jgxq

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[LOW] Craft CMS: Incorrect path validation could potentially lead to path traversal

PKSA-82nd-44zr-vpmz CVE-2026-72783 GHSA-7hxc-f267-h5q7

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS in the control panel via unescaped draft name

PKSA-x767-zzvx-956t GHSA-2rp4-x2j7-qmcc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Arbitrary user password reset leading to administrator account takeover

PKSA-s5dz-k87m-97ms GHSA-p8x7-9vfw-p7vc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE through Twig sandbox escape

PKSA-d48x-nyby-nphv CVE-2026-72781 GHSA-f5wm-88jv-g5hx

Affected version: >=4.0.0-RC1,<4.18.3|>=5.0.0-RC1,<5.10.7

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

PKSA-x2qp-qkxh-fw67 CVE-2026-14793 GHSA-9p7c-v5x3-rfx8

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

PKSA-4tjq-33kk-ghq8 CVE-2026-72778 GHSA-265m-7826-wjqm

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[HIGH] Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

PKSA-r87g-h2pd-9vq1 CVE-2026-56382 GHSA-86vw-x4ww-x467

Affected version: >=5.5.0,<=5.9.13

Reported by:
GitHub

[LOW] Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

PKSA-5x6f-x35f-73db CVE-2026-56394 GHSA-c43v-4cr8-6mvp

Affected version: >=5.0.0-RC1,<=5.9.12|>=4.0.0-RC1,<=4.17.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS via Structure entry title in table view

PKSA-z4vj-1h29-pkrc CVE-2026-55793 GHSA-xrqc-p465-2xvg

Affected version: >=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Sensitive File Disclosure / Server-Side File Read

PKSA-rvh7-y4k6-cn59 CVE-2026-55792 GHSA-287w-mxq6-x2cp

Affected version: >=5.0.0-RC1,<5.10.0|>=4.0.0-RC1,<4.18.0

Reported by:
GitHub

[HIGH] Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

PKSA-hm4p-n9yk-nz2c CVE-2026-55790 GHSA-24x4-j6x9-rfw5

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

PKSA-pqnm-5q4k-cx7j CVE-2026-56384 GHSA-x76w-8c62-48mg

Affected version: >=5.0.0-RC1,<=5.9.13|>=4.0.0-RC1,<=4.17.7

Reported by:
GitHub

[HIGH] Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

PKSA-9z7r-2kcf-76cf CVE-2026-50282 GHSA-3w32-23wj-rxg3

Affected version: >=4.0.0-RC1,<4.17.14|>=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

PKSA-zn8p-45f7-kgv1 CVE-2026-50281 GHSA-x5m4-g2cq-52pq

Affected version: >=5.7.0,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

PKSA-fd42-dyd4-g3dq CVE-2026-50284 GHSA-7h62-6v23-v8fm

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

PKSA-68rr-18x7-w4gg CVE-2026-50283 GHSA-qh45-9g5p-m2v4

Affected version: >=4.0.0-RC1,<4.17.14|>=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[MEDIUM] Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

PKSA-nhns-q2yx-ct2v CVE-2026-50280 GHSA-43cq-c2gq-pfpw

Affected version: >=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

PKSA-rg3c-2r2k-sf93 CVE-2026-50279 GHSA-qq2c-2q8j-jh27

Affected version: >=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[CRITICAL] Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

PKSA-5xds-5mf3-ckxn CVE-2026-55791 GHSA-c55v-343g-5xff

Affected version: >=4.0.0-RC1,<4.18|>=5.0.0-RC1,<5.10

Reported by:
GitHub

[HIGH] Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

PKSA-tj2m-c963-6jtt CVE-2026-44012 GHSA-33m5-hqp9-97pw

Affected version: >=5.0.0-RC1,<5.9.18

Reported by:
GitHub

[HIGH] Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

PKSA-7b21-z11x-97gc CVE-2026-44011 GHSA-qrgm-p9w5-rrfw

Affected version: >=5.0.0,<5.9.18|>=4.0.0,<4.17.12

Reported by:
GitHub

[HIGH] Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

PKSA-sxz1-z4jg-2vhh CVE-2026-44010 GHSA-gj2p-p9m4-c8gw

Affected version: >=4.0.0,<4.17.12|>=5.0.0,<5.9.18

Reported by:
GitHub

[MEDIUM] Craft CMS has a host header injection leading to SSRF via resource-js endpoint

PKSA-ntd3-69q5-4cfy CVE-2026-41130 GHSA-95wr-3f2v-v2wh

Affected version: >=4.0.0-RC1,<=4.17.8|>=5.0.0-RC1,<=5.9.14

Reported by:
GitHub

[MEDIUM] Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

PKSA-wb3t-ts8t-d4cj CVE-2026-41129 GHSA-3m9m-24vh-39wx

Affected version: >=4.0.0-RC1,<=4.17.8|>=5.0.0-RC1,<=5.9.14

Reported by:
GitHub

[MEDIUM] Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action

PKSA-dmwd-n76s-m3f9 CVE-2026-41128 GHSA-jq2f-59pj-p3m3

Affected version: >=5.6.0,<5.9.15

Reported by:
GitHub

[LOW] Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

PKSA-hq3k-cthz-b9zn CVE-2026-56385 GHSA-44px-qjjc-xrhq

Affected version: >=4.0.0-RC1,<=4.17.7|>=5.0.0-RC1,<=5.9.13

Reported by:
GitHub

[MEDIUM] Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

PKSA-7c6f-2hwc-ptwd CVE-2026-33162 GHSA-f582-6gf6-gx4g

Affected version: >=5.3.0,<=5.9.13

Reported by:
GitHub

[LOW] Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

PKSA-w984-dygq-7ryn CVE-2026-33161 GHSA-vgjg-248p-rfm2

Affected version: >=4.0.0-RC1,<=4.17.7|>=5.0.0-RC1,<=5.9.13

Reported by:
GitHub

[LOW] Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

PKSA-swp1-ty4d-gpzy CVE-2026-33160 GHSA-5pgf-h923-m958

Affected version: >=4.0.0-RC1,<=4.17.7|>=5.0.0-RC1,<=5.9.13

Reported by:
GitHub

[MEDIUM] Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

PKSA-rxrx-pcy1-2csw CVE-2026-33159 GHSA-6mrr-q3pj-h53w

Affected version: >=4.0.0-RC1,<=4.17.7|>=5.0.0-RC1,<=5.9.13

Reported by:
GitHub

[MEDIUM] Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

PKSA-548y-fsbg-y9t7 CVE-2026-33158 GHSA-3pvf-vxrv-hh9c

Affected version: >=5.0.0-RC1,<=5.9.13|>=4.0.0-RC1,<=4.17.7

Reported by:
GitHub

[HIGH] Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior

PKSA-twkq-r2c1-87qq CVE-2026-33157 GHSA-2fph-6v5w-89hh

Affected version: >=5.6.0,<=5.9.12

Reported by:
GitHub

[HIGH] Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

PKSA-s8c8-j6wr-t4ds CVE-2026-32267 GHSA-cc7p-2j3x-x7xf

Affected version: >=5.0.0-RC1,<=5.9.11|>=4.0.0-RC1,<=4.17.5

Reported by:
GitHub

[HIGH] Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

PKSA-1qxd-z2sm-yssc CVE-2026-32264 GHSA-4484-8v2f-5748

Affected version: >=5.0.0-RC1,<=5.9.10|>=4.0.0-RC1,<=4.17.4

Reported by:
GitHub

[HIGH] Craft CMS vulnerable to behavior injection RCE via EntryTypesController

PKSA-1n2n-7k4d-96rt CVE-2026-32263 GHSA-qx2q-q59v-wf3j

Affected version: >=5.6.0,<=5.9.10

Reported by:
GitHub

[MEDIUM] Craft CMS has a Path Traversal Vulnerability in AssetsController

PKSA-y7v4-m2bd-8h2y CVE-2026-32262 GHSA-472v-j2g4-g9h2

Affected version: >=5.0.0-RC1,<=5.9.10|>=4.0.0-RC1,<=4.17.4

Reported by:
GitHub

[HIGH] CraftCMS has an RCE vulnerability via relational conditionals in the control panel

PKSA-w79g-q9vy-mw7b CVE-2026-31857 GHSA-fp5j-j7j4-mcxc

Affected version: >=4.0.0-beta.1,<=4.17.3|>=5.0.0-RC1,<=5.9.8

Reported by:
GitHub

[HIGH] CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

PKSA-2bdn-bpjn-j9q4 CVE-2026-31858 GHSA-g7j6-fmwx-7vp8

Affected version: >=5.0.0-RC1,<=5.9.8

Reported by:
GitHub

[MEDIUM] CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization

PKSA-t9v1-2frg-d2wy CVE-2026-31859 GHSA-fvwq-45qv-xvhv

Affected version: >=5.7.5,<=5.9.6|>=4.15.3,<=4.17.2

Reported by:
GitHub

[LOW] Craft CMS has a potential information disclosure vulnerability in preview tokens

PKSA-24yr-dkzm-n9v5 CVE-2026-29113 GHSA-vg3j-hpm9-8v5v

Affected version: >=5.0.0-RC1,<5.9.7|>=4.0.0-RC1,<4.17.3

Reported by:
GitHub

[HIGH] Craft CMS has unauthenticated activation email trigger with potential user enumeration

PKSA-s2xd-twzp-9yz7 CVE-2026-29069 GHSA-234q-vvw3-mrfq

Affected version: >=4.0.0-RC1,<4.17.0-beta.2|>=5.0.0-RC1,<5.9.0-beta.2

Reported by:
GitHub

[MEDIUM] Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

PKSA-q22m-n7fg-cqgy CVE-2026-28784 GHSA-qc86-q28f-ggww

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[MEDIUM] Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

PKSA-c1gj-84dj-vvh3 CVE-2026-28782 GHSA-jxm3-pmm2-9gf6

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[MEDIUM] Craft CMS has Twig Function Blocklist Bypass

PKSA-x1f7-3vrt-jvfj CVE-2026-28783 GHSA-5fvc-7894-ghp4

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[MEDIUM] Craft CMS: Entries Authorship Spoofing via Mass Assignment

PKSA-zp4z-c8gp-zpww CVE-2026-28781 GHSA-2xfc-g69j-x2mp

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[CRITICAL] Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

PKSA-jqb9-4xf5-mdn1 CVE-2026-28697 GHSA-v47q-jxvr-p68x

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[LOW] Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

PKSA-skz7-x8dk-h7t1 CVE-2026-56393 GHSA-4mgv-366x-qxvx

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub

[HIGH] Craft CMS has IDOR via GraphQL @parseRefs

PKSA-ts3n-khxn-xyvm CVE-2026-28696 GHSA-7x43-mpfg-r9wj

Affected version: >=5.0.0-RC1,<5.9.0-beta.1|>=4.0.0-RC1,<4.17.0-beta.1

Reported by:
GitHub

[MEDIUM] Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

PKSA-n7dz-mnbq-y23y CVE-2026-28695 GHSA-94rc-cqvm-m4pw

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.8.7,<5.9.0-beta.1

Reported by:
GitHub

[HIGH] Craft CMS: GraphQL Asset Mutation Privilege Escalation

PKSA-zjy6-pdtw-mck8 CVE-2026-25497 GHSA-fxp3-g6gw-4r4v

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub