agentprime: cms

agentprime: cmsEvery new CVE for cms.https://agentprime.io/CVE-2026-115938: Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEhttps://agentprime.io/advisories/CVE-2026-115938/https://agentprime.io/advisories/CVE-2026-115938/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:58:51 GMTCVECVE-2026-115935: Control panel only API response emulation replaces "securityKey" and reaches server RCEhttps://agentprime.io/advisories/CVE-2026-115935/https://agentprime.io/advisories/CVE-2026-115935/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:40:57 GMTCVECVE-2026-112777: Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCEhttps://agentprime.io/advisories/CVE-2026-112777/https://agentprime.io/advisories/CVE-2026-112777/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:54 GMTCVECVE-2026-112776: Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutationshttps://agentprime.io/advisories/CVE-2026-112776/https://agentprime.io/advisories/CVE-2026-112776/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:53 GMTCVEcriticalCVE-2026-112775: Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordhttps://agentprime.io/advisories/CVE-2026-112775/https://agentprime.io/advisories/CVE-2026-112775/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:53 GMTCVECVE-2026-112774: Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layouthttps://agentprime.io/advisories/CVE-2026-112774/https://agentprime.io/advisories/CVE-2026-112774/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:52 GMTCVECVE-2026-112773: Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injectionhttps://agentprime.io/advisories/CVE-2026-112773/https://agentprime.io/advisories/CVE-2026-112773/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:51 GMTCVECVE-2026-112772: Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injectionhttps://agentprime.io/advisories/CVE-2026-112772/https://agentprime.io/advisories/CVE-2026-112772/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:51 GMTCVECVE-2026-112771: Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filtershttps://agentprime.io/advisories/CVE-2026-112771/https://agentprime.io/advisories/CVE-2026-112771/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:50 GMTCVECVE-2026-112770: Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callablehttps://agentprime.io/advisories/CVE-2026-112770/https://agentprime.io/advisories/CVE-2026-112770/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 19:10:49 GMTCVECVE-2026-109308: Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injectionhttps://agentprime.io/advisories/CVE-2026-109308/https://agentprime.io/advisories/CVE-2026-109308/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:04 GMTCVECVE-2026-109307: Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verificationhttps://agentprime.io/advisories/CVE-2026-109307/https://agentprime.io/advisories/CVE-2026-109307/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:04 GMTCVECVE-2026-109306: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-editionhttps://agentprime.io/advisories/CVE-2026-109306/https://agentprime.io/advisories/CVE-2026-109306/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:03 GMTCVECVE-2026-109305: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has everyhttps://agentprime.io/advisories/CVE-2026-109305/https://agentprime.io/advisories/CVE-2026-109305/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:01 GMTCVECVE-2026-109304: Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocumenthttps://agentprime.io/advisories/CVE-2026-109304/https://agentprime.io/advisories/CVE-2026-109304/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:00 GMTCVECVE-2026-105985: Authenticated RCE via render-components Entry Type overrideshttps://agentprime.io/advisories/CVE-2026-105985/https://agentprime.io/advisories/CVE-2026-105985/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 10:23:25 GMTCVECVE-2026-92594: Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQLhttps://agentprime.io/advisories/CVE-2026-92594/https://agentprime.io/advisories/CVE-2026-92594/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:59 GMTCVECVE-2026-92593: Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-92593/https://agentprime.io/advisories/CVE-2026-92593/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:58 GMTCVECVE-2026-92592: Craft CMS before 4.18.6 Remote Code Execution via signed cookiehttps://agentprime.io/advisories/CVE-2026-92592/https://agentprime.io/advisories/CVE-2026-92592/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:57 GMTCVECVE-2026-92591: Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installerhttps://agentprime.io/advisories/CVE-2026-92591/https://agentprime.io/advisories/CVE-2026-92591/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:57 GMTCVECVE-2026-92590: Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fieldshttps://agentprime.io/advisories/CVE-2026-92590/https://agentprime.io/advisories/CVE-2026-92590/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:56 GMTCVECVE-2026-92589: Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorderhttps://agentprime.io/advisories/CVE-2026-92589/https://agentprime.io/advisories/CVE-2026-92589/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:46:55 GMTCVECVE-2026-79987: Low-privilege RCE through element-search eager loadinghttps://agentprime.io/advisories/CVE-2026-79987/https://agentprime.io/advisories/CVE-2026-79987/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Sep 2026 16:05:55 GMTCVECVE-2026-86732: Craft CMS before 5.10.12 Remote Code Execution via element-indexhttps://agentprime.io/advisories/CVE-2026-86732/https://agentprime.io/advisories/CVE-2026-86732/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Sep 2026 15:14:02 GMTCVECVE-2026-86731: Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersControllerhttps://agentprime.io/advisories/CVE-2026-86731/https://agentprime.io/advisories/CVE-2026-86731/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Sep 2026 15:14:01 GMTCVECVE-2026-86730: Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCEhttps://agentprime.io/advisories/CVE-2026-86730/https://agentprime.io/advisories/CVE-2026-86730/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Sep 2026 15:14:00 GMTCVECVE-2026-79991: Authenticated SQL Injection via nested eager-loading criteriahttps://agentprime.io/advisories/CVE-2026-79991/https://agentprime.io/advisories/CVE-2026-79991/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 14:25:15 GMTCVECVE-2026-79990: GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deletehttps://agentprime.io/advisories/CVE-2026-79990/https://agentprime.io/advisories/CVE-2026-79990/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 14:19:54 GMTCVECVE-2026-84802: Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsControllerhttps://agentprime.io/advisories/CVE-2026-84802/https://agentprime.io/advisories/CVE-2026-84802/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:16 GMTCVECVE-2026-84801: Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsershttps://agentprime.io/advisories/CVE-2026-84801/https://agentprime.io/advisories/CVE-2026-84801/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:15 GMTCVECVE-2026-84800: Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-filehttps://agentprime.io/advisories/CVE-2026-84800/https://agentprime.io/advisories/CVE-2026-84800/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:14 GMTCVECVE-2026-84799: Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relationshttps://agentprime.io/advisories/CVE-2026-84799/https://agentprime.io/advisories/CVE-2026-84799/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:14 GMTCVECVE-2026-84798: Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSitehttps://agentprime.io/advisories/CVE-2026-84798/https://agentprime.io/advisories/CVE-2026-84798/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:13 GMTCVECVE-2026-84797: Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicatehttps://agentprime.io/advisories/CVE-2026-84797/https://agentprime.io/advisories/CVE-2026-84797/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:12 GMTCVECVE-2026-84796: Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypasshttps://agentprime.io/advisories/CVE-2026-84796/https://agentprime.io/advisories/CVE-2026-84796/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:12 GMTCVECVE-2026-84795: Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritancehttps://agentprime.io/advisories/CVE-2026-84795/https://agentprime.io/advisories/CVE-2026-84795/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:11 GMTCVEcriticalCVE-2026-84794: Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assethttps://agentprime.io/advisories/CVE-2026-84794/https://agentprime.io/advisories/CVE-2026-84794/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:10 GMTCVECVE-2026-84793: Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site namehttps://agentprime.io/advisories/CVE-2026-84793/https://agentprime.io/advisories/CVE-2026-84793/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:09 GMTCVECVE-2026-84792: Craft CMS before 5.10.11 Broken Access Control via element-indexeshttps://agentprime.io/advisories/CVE-2026-84792/https://agentprime.io/advisories/CVE-2026-84792/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 11:11:09 GMTCVECVE-2026-79988: Authenticated RCE through Twig sandbox escapehttps://agentprime.io/advisories/CVE-2026-79988/https://agentprime.io/advisories/CVE-2026-79988/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 15:36:18 GMTCVECVE-2026-78416: Authenticated RCE via `condition.config` JSON cleanse bypasshttps://agentprime.io/advisories/CVE-2026-78416/https://agentprime.io/advisories/CVE-2026-78416/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 15:36:07 GMTCVECVE-2026-72784: Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutationhttps://agentprime.io/advisories/CVE-2026-72784/https://agentprime.io/advisories/CVE-2026-72784/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 12:17:18 GMTCVE