Lucene search
+L

20000 matches found

Tenable Nessus
Tenable Nessus
added 2026/03/18 12:0 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-23261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-fc: release admin tagset if init fails nvmefabrics creates an NVMe/FC controller in following path: nvmfdevwrite - nvmfcreatectrl - nvmefccreatectrl -...

5.5CVSS5.6AI score0.00114EPSS
SaveExploits0References3
NVD
NVD
added 2026/03/16 8:16 p.m.13 views

CVE-2026-32263

Craft CMS is a content management system CMS. From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parsestr is passed directly to Craft::configure without Component::cleanseConfig. This allows injecting Yii2 behavior/event handlers via...

8.6CVSS0.00499EPSS
SaveExploits0References3
CVE
CVE
added 2026/03/16 7:4 p.m.27 views

CVE-2026-32267

Craft CMS vulnerable to privilege escalation via UsersController->actionImpersonateWithToken. From 4.0.0-RC1 up to 4.17.5 and 5.0.0-RC1 up to 5.9.11, a low-privilege or unauthenticated user with a shared URL can escalate to admin. Patch versions: 4.17.6 and 5.9.12. CVSS 4.0 base score 9.2 (CRI...

9.8CVSS5.7AI score0.0773EPSS
SaveExploits1References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/16 7:2 p.m.5 views

CVE-2026-32264 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and...

8.6CVSS5.7AI score0.00515EPSS
SaveExploits0References4
CVE
CVE
added 2026/03/16 7:2 p.m.29 views

CVE-2026-32264

CVE-2026-32264 in Craft CMS affects the ElementIndexesController and FieldsController. From 4.0.0-RC1 up to just before 4.17.5, and from 5.0.0-RC1 up to just before 5.9.11, a Behavior injection remote code execution vulnerability exists when an administrator with enable admin changes (allowAdminC...

8.6CVSS5.7AI score0.00515EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2026/03/16 7:2 p.m.39 views

CVE-2026-32264 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and...

8.6CVSS0.00515EPSS
SaveExploits0References4
OSV
OSV
added 2026/03/16 7:2 p.m.10 views

CVE-2026-32264 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and...

8.6CVSS5.8AI score
SaveExploits0References6
CVE
CVE
added 2026/03/16 6:57 p.m.21 views

CVE-2026-32263

Craft CMS (versions 5.6.0–5.9.10) is vulnerable where parse_str-derived $settings in src/controllers/EntryTypesController.php is passed directly to Craft::configure() without cleansing via Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers through keys prefixed with "a...

8.6CVSS5.7AI score0.00499EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/16 6:57 p.m.4 views

CVE-2026-32263 Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Craft CMS is a content management system CMS. From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parsestr is passed directly to Craft::configure without Component::cleanseConfig. This allows injecting Yii2 behavior/event handlers via...

8.6CVSS5.7AI score0.00499EPSS
SaveExploits0References3
OSV
OSV
added 2026/03/16 6:57 p.m.15 views

CVE-2026-32263 Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Craft CMS is a content management system CMS. From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parsestr is passed directly to Craft::configure without Component::cleanseConfig. This allows injecting Yii2 behavior/event handlers via...

8.6CVSS5.7AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/03/16 6:57 p.m.29 views

CVE-2026-32262 Craft CMS has a Path Traversal Vulnerability in AssetsController

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController-replaceFile method has a targetFilename body parameter that is used unsanitized in a deleteFile call before...

5.3CVSS0.00291EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/03/16 6:57 p.m.5 views

CVE-2026-32262 Craft CMS has a Path Traversal Vulnerability in AssetsController

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController-replaceFile method has a targetFilename body parameter that is used unsanitized in a deleteFile call before...

5.3CVSS5.8AI score0.00291EPSS
SaveExploits0References2
CVE
CVE
added 2026/03/16 6:57 p.m.19 views

CVE-2026-32262

Craft CMS is affected by a path traversal vulnerability (CVE-2026-32262) where AssetsController->replaceFile() uses an unsanitized targetFilename in deleteFile() before Assets::prepareAssetName() on save. An authenticated user with replaceFiles permission can delete arbitrary files on the same...

5.3CVSS5.8AI score0.00291EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/03/16 6:44 p.m.8 views

EUVD-2026-12508

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController-actionImpersonateWithToken...

9.2CVSS5.8AI score0.0773EPSS
SaveExploits1References2
OSV
OSV
added 2026/03/16 6:14 p.m.5 views

GHSA-67CR-JMH8-4JPQ Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

Unauthenticated users can view a list of buckets the plugin has access to. The DefaultController-actionLoadBucketData endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to...

6.9CVSS5.8AI score0.00344EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/03/16 6:13 p.m.5 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the BucketsController-actionLoadBucketData endpoint. An attacker can retrieve a list of accessible buckets by sending a request with a valid CSRF token, even without authentication. Remediation Upgrade...

6.9CVSS5.8AI score0.00344EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/16 6:13 p.m.11 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the ElementIndexesController and FieldsController components. An attacker can execute arbitrary code by...

8.6CVSS6.2AI score0.00515EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/03/16 6:13 p.m.19 views

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController. You need Craft contro...

8.6CVSS5.8AI score0.00515EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/03/16 6:13 p.m.21 views

GHSA-4484-8V2F-5748 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController. You need Craft contro...

8.6CVSS5.8AI score0.00515EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/03/16 6:12 p.m.9 views

EUVD-2026-12504

Craft CMS vulnerable to behavior injection RCE via EntryTypesController...

8.6CVSS5.8AI score0.00499EPSS
SaveExploits0References3
Rows per page
Query Builder