CVEs affecting 4.0
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-115934 | SQL injection leading to privilege escalation | 9.3 | — | 2026-11-10 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | 9.3 | — | 2026-11-07 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | 8.8 | — | 2026-11-07 | |
| CVE-2026-72779 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | 8.7 | — | 2026-08-11 | |
| CVE-2026-112770 | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | 8.7 | — | 2026-10-20 | |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | 8.7 | — | 2026-08-28 | |
| CVE-2026-78416 | Authenticated RCE via `condition.config` JSON cleanse bypass | 8.7 | — | 2026-08-25 | |
| CVE-2026-112777 | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | 8.7 | — | 2026-10-20 | |
| CVE-2026-72778 | Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | 8.7 | — | 2026-08-11 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 8.7 | — | 2026-10-13 | |
| CVE-2026-72781 | Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | 8.7 | — | 2026-08-11 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | 7.1 | — | 2026-11-07 | |
| CVE-2026-72782 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | 7.1 | — | 2026-08-11 | |
| CVE-2026-112771 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | 7.1 | — | 2026-10-20 | |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | 7.1 | — | 2026-06-21 | |
| CVE-2026-72784 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | 6.9 | — | 2026-08-11 | |
| CVE-2026-109304 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | 6.9 | — | 2026-10-13 | |
| CVE-2026-72783 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | 6.9 | — | 2026-08-11 | |
| CVE-2026-56385 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-56384 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | 4.6 | — | 2026-06-21 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).