Fixed in
CVEs affecting 5.8
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-124427 | Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | 9.3 | — | 2026-11-08 | |
| CVE-2026-112776 | Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations | 9.3 | — | 2026-10-20 | |
| CVE-2026-115934 | SQL injection leading to privilege escalation | 9.3 | — | 2026-11-10 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | 9.3 | — | 2026-11-07 | |
| CVE-2026-72785 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element | 9.3 | — | 2026-08-11 | |
| CVE-2026-84795 | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance | 9.2 | — | 2026-09-02 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | 8.8 | — | 2026-11-07 | |
| CVE-2026-72779 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | 8.7 | — | 2026-08-11 | |
| CVE-2026-123490 | Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass | 8.7 | — | 2026-11-07 | |
| CVE-2026-92594 | Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL | 8.7 | — | 2026-09-17 | |
| CVE-2026-79990 | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete | 8.7 | — | 2026-09-02 | |
| CVE-2026-84801 | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers | 8.7 | — | 2026-09-02 | |
| CVE-2026-112770 | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | 8.7 | — | 2026-10-20 | |
| CVE-2026-84796 | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass | 8.7 | — | 2026-09-02 | |
| CVE-2026-112775 | Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password | 8.7 | — | 2026-10-20 | |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | 8.7 | — | 2026-08-28 | |
| CVE-2026-86730 | Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE | 8.7 | — | 2026-09-09 | |
| CVE-2026-78416 | Authenticated RCE via `condition.config` JSON cleanse bypass | 8.7 | — | 2026-08-25 | |
| CVE-2026-124429 | Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration | 8.7 | — | 2026-11-08 | |
| CVE-2026-112777 | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | 8.7 | — | 2026-10-20 | |
| CVE-2026-72778 | Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | 8.7 | — | 2026-08-11 | |
| CVE-2026-112773 | Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection | 8.7 | — | 2026-10-20 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | 8.7 | — | 2026-09-09 | |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 8.7 | — | 2026-10-13 | |
| CVE-2026-72781 | Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | 8.7 | — | 2026-08-11 | |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | 8.7 | — | 2026-09-11 | |
| CVE-2026-105985 | Authenticated RCE via render-components Entry Type overrides | 8.7 | — | 2026-10-06 | |
| CVE-2026-92592 | Craft CMS before 4.18.6 Remote Code Execution via signed cookie | 8.7 | — | 2026-09-17 | |
| CVE-2026-79989 | Arbitrary user password reset leading to administrator account takeover | 8.7 | — | 2026-09-02 | |
| CVE-2026-112772 | Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection | 8.7 | — | 2026-10-20 | |
| CVE-2026-112774 | Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout | 8.7 | — | 2026-10-20 | |
| CVE-2026-56382 | Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController | 8.6 | — | 2026-06-21 | |
| CVE-2026-92591 | Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer | 8.2 | — | 2026-09-17 | |
| CVE-2026-84800 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file | 7.1 | — | 2026-09-02 | |
| CVE-2026-84794 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset | 7.1 | — | 2026-09-02 | |
| CVE-2026-79991 | Authenticated SQL Injection via nested eager-loading criteria | 7.1 | — | 2026-09-02 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | 7.1 | — | 2026-11-07 | |
| CVE-2026-72782 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | 7.1 | — | 2026-08-11 | |
| CVE-2026-84798 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite | 7.1 | — | 2026-09-02 | |
| CVE-2026-112771 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | 7.1 | — | 2026-10-20 | |
| CVE-2026-86731 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController | 7.1 | — | 2026-09-09 | |
| CVE-2026-72780 | Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey | 7.1 | — | 2026-08-11 | |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | 7.1 | — | 2026-06-21 | |
| CVE-2026-124428 | Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg | 7.1 | — | 2026-11-08 | |
| CVE-2026-72786 | Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset | 7.1 | — | 2026-08-13 | |
| CVE-2026-124426 | Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field | 6.9 | — | 2026-11-08 | |
| CVE-2026-72784 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | 6.9 | — | 2026-08-11 | |
| CVE-2026-109304 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | 6.9 | — | 2026-10-13 | |
| CVE-2026-72783 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | 6.9 | — | 2026-08-11 | |
| CVE-2026-109306 | Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition | 6.0 | — | 2026-10-13 | |
| CVE-2026-56385 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-92589 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder | 5.3 | — | 2026-09-17 | |
| CVE-2026-84797 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate | 5.3 | — | 2026-09-02 | |
| CVE-2026-56384 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-84799 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations | 5.3 | — | 2026-09-02 | |
| CVE-2026-84802 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController | 5.3 | — | 2026-09-02 | |
| CVE-2026-84792 | Craft CMS before 5.10.11 Broken Access Control via element-indexes | 5.3 | — | 2026-09-02 | |
| CVE-2026-72787 | Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name | 5.1 | — | 2026-08-13 | |
| CVE-2026-92590 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields | 5.1 | — | 2026-09-17 | |
| CVE-2026-84793 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name | 4.8 | — | 2026-09-02 | |
| CVE-2026-56383 | Craft CMS - Stored XSS in Table Field via Row Heading Column Type | 4.6 | — | 2026-06-21 | |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | 4.6 | — | 2026-06-21 | |
| CVE-2026-56381 | Craft CMS - Stored XSS via User Group Name in User Permissions Page | 4.6 | — | 2026-06-21 | |
| CVE-2026-109307 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | 2.1 | — | 2026-10-13 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).