Corrigé dans
CVE affectant 4.18
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2026-115934 | SQL injection leading to privilege escalation | 9.3 | — | 2026-11-10 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | 9.3 | — | 2026-11-07 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | 8.8 | — | 2026-11-07 | |
| CVE-2026-72779 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | 8.7 | — | 2026-08-11 | |
| CVE-2026-112770 | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | 8.7 | — | 2026-10-20 | |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | 8.7 | — | 2026-08-28 | |
| CVE-2026-78416 | Authenticated RCE via `condition.config` JSON cleanse bypass | 8.7 | — | 2026-08-25 | |
| CVE-2026-112777 | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | 8.7 | — | 2026-10-20 | |
| CVE-2026-72778 | Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | 8.7 | — | 2026-08-11 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 8.7 | — | 2026-10-13 | |
| CVE-2026-72781 | Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | 8.7 | — | 2026-08-11 | |
| CVE-2026-92592 | Craft CMS before 4.18.6 Remote Code Execution via signed cookie | 8.7 | — | 2026-09-17 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | 7.1 | — | 2026-11-07 | |
| CVE-2026-72782 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | 7.1 | — | 2026-08-11 | |
| CVE-2026-112771 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | 7.1 | — | 2026-10-20 | |
| CVE-2026-72784 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | 6.9 | — | 2026-08-11 | |
| CVE-2026-109304 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | 6.9 | — | 2026-10-13 | |
| CVE-2026-72783 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | 6.9 | — | 2026-08-11 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).