[MEDIUM] Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

PKSA-19kf-75v5-vy76 CVE-2026-72779 GHSA-957r-qf9p-67xw

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Authenticated leak of secret environment variables

PKSA-4q3g-gxhk-813s CVE-2026-72782 GHSA-596p-6jv8-775v

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

PKSA-1412-5vdy-cd6w CVE-2026-14794 GHSA-rvmm-v933-jgxq

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[LOW] Craft CMS: Incorrect path validation could potentially lead to path traversal

PKSA-82nd-44zr-vpmz CVE-2026-72783 GHSA-7hxc-f267-h5q7

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE through Twig sandbox escape

PKSA-d48x-nyby-nphv CVE-2026-72781 GHSA-f5wm-88jv-g5hx

Affected version: >=4.0.0-RC1,<4.18.3|>=5.0.0-RC1,<5.10.7

Reported by:
GitHub

[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

PKSA-x2qp-qkxh-fw67 CVE-2026-14793 GHSA-9p7c-v5x3-rfx8

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub

[HIGH] Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

PKSA-4tjq-33kk-ghq8 CVE-2026-72778 GHSA-265m-7826-wjqm

Affected version: >=4.0.0-RC1,<4.18.2|>=5.0.0-RC1,<5.10.6

Reported by:
GitHub

[MEDIUM] Craft CMS: Sensitive File Disclosure / Server-Side File Read

PKSA-rvh7-y4k6-cn59 CVE-2026-55792 GHSA-287w-mxq6-x2cp

Affected version: >=5.0.0-RC1,<5.10.0|>=4.0.0-RC1,<4.18.0

Reported by:
GitHub

[CRITICAL] Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

PKSA-5xds-5mf3-ckxn CVE-2026-55791 GHSA-c55v-343g-5xff

Affected version: >=4.0.0-RC1,<4.18|>=5.0.0-RC1,<5.10

Reported by:
GitHub