Исправлено в
CVE, затрагивающие 5.11
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2026-124427 | Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | 9.3 | — | 2026-11-08 | |
| CVE-2026-115934 | SQL injection leading to privilege escalation | 9.3 | — | 2026-11-10 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | 9.3 | — | 2026-11-07 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | 8.8 | — | 2026-11-07 | |
| CVE-2026-123490 | Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass | 8.7 | — | 2026-11-07 | |
| CVE-2026-124430 | Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle | 8.7 | — | 2026-11-08 | |
| CVE-2026-124429 | Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration | 8.7 | — | 2026-11-08 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 | — | 2026-10-24 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | 7.1 | — | 2026-11-07 | |
| CVE-2026-124428 | Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg | 7.1 | — | 2026-11-08 | |
| CVE-2026-124426 | Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field | 6.9 | — | 2026-11-08 | |
| CVE-2026-124431 | Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement | 5.3 | — | 2026-11-08 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).