# cms.

Every CVE that names cms among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE](https://agentprime.io/advisories/CVE-2026-115938.md)
  `CVE-2026-115938` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [Control panel only API response emulation replaces "securityKey" and reaches server RCE](https://agentprime.io/advisories/CVE-2026-115935.md)
  `CVE-2026-115935` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE](https://agentprime.io/advisories/CVE-2026-112777.md)
  `CVE-2026-112777` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-184
- [Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations](https://agentprime.io/advisories/CVE-2026-112776.md)
  `CVE-2026-112776` · CVE record: craftcms cms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password](https://agentprime.io/advisories/CVE-2026-112775.md)
  `CVE-2026-112775` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout](https://agentprime.io/advisories/CVE-2026-112774.md)
  `CVE-2026-112774` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection](https://agentprime.io/advisories/CVE-2026-112773.md)
  `CVE-2026-112773` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection](https://agentprime.io/advisories/CVE-2026-112772.md)
  `CVE-2026-112772` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters](https://agentprime.io/advisories/CVE-2026-112771.md)
  `CVE-2026-112771` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable](https://agentprime.io/advisories/CVE-2026-112770.md)
  `CVE-2026-112770` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection](https://agentprime.io/advisories/CVE-2026-109308.md)
  `CVE-2026-109308` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification](https://agentprime.io/advisories/CVE-2026-109307.md)
  `CVE-2026-109307` · CVE record: craftcms cms · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition](https://agentprime.io/advisories/CVE-2026-109306.md)
  `CVE-2026-109306` · CVE record: craftcms cms · CVSS 6.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every](https://agentprime.io/advisories/CVE-2026-109305.md)
  `CVE-2026-109305` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection
- [Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument](https://agentprime.io/advisories/CVE-2026-109304.md)
  `CVE-2026-109304` · CVE record: craftcms cms · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure
- [Authenticated RCE via render-components Entry Type overrides](https://agentprime.io/advisories/CVE-2026-105985.md)
  `CVE-2026-105985` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL](https://agentprime.io/advisories/CVE-2026-92594.md)
  `CVE-2026-92594` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure
- [Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-92593.md)
  `CVE-2026-92593` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [Craft CMS before 4.18.6 Remote Code Execution via signed cookie](https://agentprime.io/advisories/CVE-2026-92592.md)
  `CVE-2026-92592` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer](https://agentprime.io/advisories/CVE-2026-92591.md)
  `CVE-2026-92591` · CVE record: craftcms cms · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-636
- [Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields](https://agentprime.io/advisories/CVE-2026-92590.md)
  `CVE-2026-92590` · CVE record: craftcms cms · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder](https://agentprime.io/advisories/CVE-2026-92589.md)
  `CVE-2026-92589` · CVE record: craftcms cms · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Low-privilege RCE through element-search eager loading](https://agentprime.io/advisories/CVE-2026-79987.md)
  `CVE-2026-79987` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection
- [Craft CMS before 5.10.12 Remote Code Execution via element-index](https://agentprime.io/advisories/CVE-2026-86732.md)
  `CVE-2026-86732` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController](https://agentprime.io/advisories/CVE-2026-86731.md)
  `CVE-2026-86731` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE](https://agentprime.io/advisories/CVE-2026-86730.md)
  `CVE-2026-86730` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Authenticated SQL Injection via nested eager-loading criteria](https://agentprime.io/advisories/CVE-2026-79991.md)
  `CVE-2026-79991` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: SQL injection
- [GQL entry mutation \`siteId\` bypasses schema site scope, enabling cross-site content read/write/delete](https://agentprime.io/advisories/CVE-2026-79990.md)
  `CVE-2026-79990` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController](https://agentprime.io/advisories/CVE-2026-84802.md)
  `CVE-2026-84802` · CVE record: craftcms cms · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers](https://agentprime.io/advisories/CVE-2026-84801.md)
  `CVE-2026-84801` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file](https://agentprime.io/advisories/CVE-2026-84800.md)
  `CVE-2026-84800` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations](https://agentprime.io/advisories/CVE-2026-84799.md)
  `CVE-2026-84799` · CVE record: craftcms cms · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite](https://agentprime.io/advisories/CVE-2026-84798.md)
  `CVE-2026-84798` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate](https://agentprime.io/advisories/CVE-2026-84797.md)
  `CVE-2026-84797` · CVE record: craftcms cms · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass](https://agentprime.io/advisories/CVE-2026-84796.md)
  `CVE-2026-84796` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance](https://agentprime.io/advisories/CVE-2026-84795.md)
  `CVE-2026-84795` · CVE record: craftcms cms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Privilege escalation
- [Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset](https://agentprime.io/advisories/CVE-2026-84794.md)
  `CVE-2026-84794` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name](https://agentprime.io/advisories/CVE-2026-84793.md)
  `CVE-2026-84793` · CVE record: craftcms cms · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Craft CMS before 5.10.11 Broken Access Control via element-indexes](https://agentprime.io/advisories/CVE-2026-84792.md)
  `CVE-2026-84792` · CVE record: craftcms cms · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Authenticated RCE through Twig sandbox escape](https://agentprime.io/advisories/CVE-2026-79988.md)
  `CVE-2026-79988` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-693
- [Authenticated RCE via \`condition.config\` JSON cleanse bypass](https://agentprime.io/advisories/CVE-2026-78416.md)
  `CVE-2026-78416` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation](https://agentprime.io/advisories/CVE-2026-72784.md)
  `CVE-2026-72784` · CVE record: craftcms cms · CVSS 6.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=cms>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/cms/>. Everything for agents: <https://agentprime.io/llms.txt>.