[CRITICAL] Craft CMS: Passkey login accepts replayed WebAuthn assertions

PKSA-jk69-ryht-534b GHSA-wg23-69c2-gjc8

Affected version: >=5.0.0-RC1,<5.10.5

Reported by:
GitHub

[MEDIUM] Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

PKSA-19kf-75v5-vy76 CVE-2026-72779 GHSA-957r-qf9p-67xw

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authenticated leak of secret environment variables

PKSA-4q3g-gxhk-813s CVE-2026-72782 GHSA-596p-6jv8-775v

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

PKSA-gh5w-x99g-b53n CVE-2026-72785 GHSA-xxpx-f366-4xpq

Affected version: >=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

PKSA-1412-5vdy-cd6w CVE-2026-14794 GHSA-rvmm-v933-jgxq

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[LOW] Craft CMS: Incorrect path validation could potentially lead to path traversal

PKSA-82nd-44zr-vpmz CVE-2026-72783 GHSA-7hxc-f267-h5q7

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS in the control panel via unescaped draft name

PKSA-x767-zzvx-956t GHSA-2rp4-x2j7-qmcc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Arbitrary user password reset leading to administrator account takeover

PKSA-s5dz-k87m-97ms GHSA-p8x7-9vfw-p7vc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE through Twig sandbox escape

PKSA-d48x-nyby-nphv CVE-2026-72781 GHSA-f5wm-88jv-g5hx

Affected version: >=4.0.0-RC1,<4.18.3|>=5.0.0-RC1,<5.10.7

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

PKSA-x2qp-qkxh-fw67 CVE-2026-14793 GHSA-9p7c-v5x3-rfx8

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

PKSA-4tjq-33kk-ghq8 CVE-2026-72778 GHSA-265m-7826-wjqm

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[HIGH] Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

PKSA-hvdm-8k9p-kcdw CVE-2026-55794 GHSA-f74w-488g-8x5r

Affected version: >=5.9.0,<5.10.0

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS via Structure entry title in table view

PKSA-z4vj-1h29-pkrc CVE-2026-55793 GHSA-xrqc-p465-2xvg

Affected version: >=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Sensitive File Disclosure / Server-Side File Read

PKSA-rvh7-y4k6-cn59 CVE-2026-55792 GHSA-287w-mxq6-x2cp

Affected version: >=5.0.0-RC1,<5.10.0|>=4.0.0-RC1,<4.18.0

Reported by:
GitHub

[HIGH] Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

PKSA-hm4p-n9yk-nz2c CVE-2026-55790 GHSA-24x4-j6x9-rfw5

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[HIGH] Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

PKSA-9z7r-2kcf-76cf CVE-2026-50282 GHSA-3w32-23wj-rxg3

Affected version: >=4.0.0-RC1,<4.17.14|>=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

PKSA-zn8p-45f7-kgv1 CVE-2026-50281 GHSA-x5m4-g2cq-52pq

Affected version: >=5.7.0,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

PKSA-fd42-dyd4-g3dq CVE-2026-50284 GHSA-7h62-6v23-v8fm

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

PKSA-68rr-18x7-w4gg CVE-2026-50283 GHSA-qh45-9g5p-m2v4

Affected version: >=4.0.0-RC1,<4.17.14|>=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[MEDIUM] Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

PKSA-nhns-q2yx-ct2v CVE-2026-50280 GHSA-43cq-c2gq-pfpw

Affected version: >=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[HIGH] Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

PKSA-rg3c-2r2k-sf93 CVE-2026-50279 GHSA-qq2c-2q8j-jh27

Affected version: >=5.0.0-RC1,<5.9.21

Reported by:
GitHub

[CRITICAL] Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

PKSA-5xds-5mf3-ckxn CVE-2026-55791 GHSA-c55v-343g-5xff

Affected version: >=4.0.0-RC1,<4.18|>=5.0.0-RC1,<5.10

Reported by:
GitHub

[HIGH] Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

PKSA-tj2m-c963-6jtt CVE-2026-44012 GHSA-33m5-hqp9-97pw

Affected version: >=5.0.0-RC1,<5.9.18

Reported by:
GitHub

[HIGH] Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

PKSA-7b21-z11x-97gc CVE-2026-44011 GHSA-qrgm-p9w5-rrfw

Affected version: >=5.0.0,<5.9.18|>=4.0.0,<4.17.12

Reported by:
GitHub

[HIGH] Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

PKSA-sxz1-z4jg-2vhh CVE-2026-44010 GHSA-gj2p-p9m4-c8gw

Affected version: >=4.0.0,<4.17.12|>=5.0.0,<5.9.18

Reported by:
GitHub