[CRITICAL] Craft CMS: Passkey login accepts replayed WebAuthn assertions

PKSA-jk69-ryht-534b GHSA-wg23-69c2-gjc8

Affected version: >=5.0.0-RC1,<5.10.5

Reported by:
GitHub

[MEDIUM] Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

PKSA-19kf-75v5-vy76 CVE-2026-72779 GHSA-957r-qf9p-67xw

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authenticated leak of secret environment variables

PKSA-4q3g-gxhk-813s CVE-2026-72782 GHSA-596p-6jv8-775v

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

PKSA-gh5w-x99g-b53n CVE-2026-72785 GHSA-xxpx-f366-4xpq

Affected version: >=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

PKSA-1412-5vdy-cd6w CVE-2026-14794 GHSA-rvmm-v933-jgxq

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[LOW] Craft CMS: Incorrect path validation could potentially lead to path traversal

PKSA-82nd-44zr-vpmz CVE-2026-72783 GHSA-7hxc-f267-h5q7

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS in the control panel via unescaped draft name

PKSA-x767-zzvx-956t GHSA-2rp4-x2j7-qmcc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Arbitrary user password reset leading to administrator account takeover

PKSA-s5dz-k87m-97ms GHSA-p8x7-9vfw-p7vc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE through Twig sandbox escape

PKSA-d48x-nyby-nphv CVE-2026-72781 GHSA-f5wm-88jv-g5hx

Affected version: >=4.0.0-RC1,<4.18.3|>=5.0.0-RC1,<5.10.7

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

PKSA-x2qp-qkxh-fw67 CVE-2026-14793 GHSA-9p7c-v5x3-rfx8

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

PKSA-4tjq-33kk-ghq8 CVE-2026-72778 GHSA-265m-7826-wjqm

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[HIGH] Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

PKSA-hvdm-8k9p-kcdw CVE-2026-55794 GHSA-f74w-488g-8x5r

Affected version: >=5.9.0,<5.10.0

Reported by:
GitHub

[MEDIUM] Craft CMS: Stored XSS via Structure entry title in table view

PKSA-z4vj-1h29-pkrc CVE-2026-55793 GHSA-xrqc-p465-2xvg

Affected version: >=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[MEDIUM] Craft CMS: Sensitive File Disclosure / Server-Side File Read

PKSA-rvh7-y4k6-cn59 CVE-2026-55792 GHSA-287w-mxq6-x2cp

Affected version: >=5.0.0-RC1,<5.10.0|>=4.0.0-RC1,<4.18.0

Reported by:
GitHub

[HIGH] Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

PKSA-hm4p-n9yk-nz2c CVE-2026-55790 GHSA-24x4-j6x9-rfw5

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[HIGH] Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

PKSA-fd42-dyd4-g3dq CVE-2026-50284 GHSA-7h62-6v23-v8fm

Affected version: >=4.0.0-RC1,<4.17.15|>=5.0.0-RC1,<5.9.22

Reported by:
GitHub

[CRITICAL] Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

PKSA-5xds-5mf3-ckxn CVE-2026-55791 GHSA-c55v-343g-5xff

Affected version: >=4.0.0-RC1,<4.18|>=5.0.0-RC1,<5.10

Reported by:
GitHub