4.0 에 영향을 주는 CVE
| CVE | 제목 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|
| CVE-2026-115934 | SQL injection leading to privilege escalation | 9.3 | — | 2026-11-10 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | 9.3 | — | 2026-11-07 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | 8.8 | — | 2026-11-07 | |
| CVE-2026-72779 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | 8.7 | — | 2026-08-11 | |
| CVE-2026-112770 | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | 8.7 | — | 2026-10-20 | |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | 8.7 | — | 2026-08-28 | |
| CVE-2026-78416 | Authenticated RCE via `condition.config` JSON cleanse bypass | 8.7 | — | 2026-08-25 | |
| CVE-2026-112777 | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | 8.7 | — | 2026-10-20 | |
| CVE-2026-72778 | Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | 8.7 | — | 2026-08-11 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 8.7 | — | 2026-10-13 | |
| CVE-2026-72781 | Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | 8.7 | — | 2026-08-11 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | 7.1 | — | 2026-11-07 | |
| CVE-2026-72782 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | 7.1 | — | 2026-08-11 | |
| CVE-2026-112771 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | 7.1 | — | 2026-10-20 | |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | 7.1 | — | 2026-06-21 | |
| CVE-2026-72784 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | 6.9 | — | 2026-08-11 | |
| CVE-2026-109304 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | 6.9 | — | 2026-10-13 | |
| CVE-2026-72783 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | 6.9 | — | 2026-08-11 | |
| CVE-2026-56385 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-56384 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint | 5.3 | — | 2026-06-21 | |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | 4.6 | — | 2026-06-21 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).