Vulnerability Database

CLSA-2026-1790174106

TuxCare:Packagist/craftcms/cms

TuxCare security update for craftcms/cms (1 CVE) 23 Sep

Fix available

CLSA-2026-1789415531

TuxCare:Packagist/craftcms/cms

TuxCare security update for craftcms/cms (1 CVE) 14 Sep

Fix available

CLSA-2026-1788430341

TuxCare:Packagist/craftcms/cms

TuxCare security update for craftcms/cms (4 CVEs) 03 Sep

Fix available

CLSA-2026-1786625623

TuxCare:Packagist/craftcms/cms

TuxCare security update for craftcms/cms (1 CVE) 13 Aug

Fix available

GHSA-wg23-69c2-gjc8

Packagist/craftcms/cms

Craft CMS: Passkey login accepts replayed WebAuthn assertions 07 Aug

Fix available
Severity - 9.1 (Critical)

GHSA-957r-qf9p-67xw

Packagist/craftcms/cms

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts 06 Aug

Fix available
Severity - 6.9 (Medium)

GHSA-596p-6jv8-775v

Packagist/craftcms/cms

Craft CMS: Authenticated leak of secret environment variables 06 Aug

Fix available
Severity - 5.1 (Medium)

GHSA-xxpx-f366-4xpq

Packagist/craftcms/cms

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element 06 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-rvmm-v933-jgxq

Packagist/craftcms/cms

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics 06 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-7hxc-f267-h5q7

Packagist/craftcms/cms

Craft CMS: Incorrect path validation could potentially lead to path traversal 06 Aug

Fix available
Severity - 2.1 (Low)

GHSA-2rp4-x2j7-qmcc

Packagist/craftcms/cms

Craft CMS: Stored XSS in the control panel via unescaped draft name 06 Aug

Fix available
Severity - 5.1 (Medium)

GHSA-p8x7-9vfw-p7vc

Packagist/craftcms/cms

Craft CMS: Arbitrary user password reset leading to administrator account takeover 06 Aug

Fix available

GHSA-f5wm-88jv-g5hx

Packagist/craftcms/cms

Craft CMS: Authenticated RCE through Twig sandbox escape 06 Aug

Fix available
Severity - 8.7 (High)

GHSA-9p7c-v5x3-rfx8

Packagist/craftcms/cms

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets 06 Aug

Fix available
Severity - 4.3 (Medium)

GHSA-265m-7826-wjqm

Packagist/craftcms/cms

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass 06 Aug

Fix available
Severity - 8.7 (High)

CLSA-2026-1784682948

TuxCare:Packagist/craftcms/cms

TuxCare security update for craftcms/cms (14 CVEs) 04 Aug

Fix available

Vulnerabilities