Critical
CVE-2026-72780
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 127
Reset filters
Medium
CVE-2026-72779
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium
CVE-2026-72782
Craft CMS: Authenticated leak of secret environment variables
Medium
CVE-2026-72785
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium
CVE-2026-14794
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Low
CVE-2026-72783
Craft CMS: Incorrect path validation could potentially lead to path traversal
Medium
CVE-2026-72787
Craft CMS: Stored XSS in the control panel via unescaped draft name
High
CVE-2026-72786
Craft CMS: Arbitrary user password reset leading to administrator account takeover
High
CVE-2026-72781
Craft CMS: Authenticated RCE through Twig sandbox escape
Medium
CVE-2026-14793
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
High
CVE-2026-56382
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Low
CVE-2026-56394
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
High
CVE-2026-55794
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
High
CVE-2026-55790
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Medium
CVE-2026-56384
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
High
CVE-2026-50282
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
High
CVE-2026-50281
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
High
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Medium
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Medium
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
High
CVE-2026-50279
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.