CVE-2026-55791

Craft CMS vulnerability CVE-2026-55791 enables SSRF and Arbitrary JavaScript Injection via /actions/app/resource-js when assetManager.cacheSourcePaths is false and trustedHosts is permissive. An attacker can poison Host/X-Forwarded-Host to hijack $baseUrl, causing Craft::createGuzzleClient()->...

CVE-2026-10636

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmcmot7j22...

CVE-2026-10639

creationtimestamp| type| source ---|---|--- 2026-07-01 22:53:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmmbz24w32i...

CVE-2026-57692

creationtimestamp| type| source ---|---|--- 2026-07-01 22:48:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlzfgar22o...

CVE-2026-53349

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlwvpaaw2r 2026-07-06 06:53:14+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53343

creationtimestamp| type| source ---|---|--- 2026-07-01 22:47:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlwffjm32u 2026-07-06 06:53:11+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53351

creationtimestamp| type| source ---|---|--- 2026-07-01 22:46:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlvv3owd2d...

CVE-2026-53356

creationtimestamp| type| source ---|---|--- 2026-07-01 22:42:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlnl6wwd2i 2026-07-06 06:53:27+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53354

creationtimestamp| type| source ---|---|--- 2026-07-01 22:41:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlmtk27t2i 2026-07-06 06:53:22+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-10 16:46:52+00:00|...

CVE-2026-53345

creationtimestamp| type| source ---|---|--- 2026-07-01 22:37:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlf33ux32i 2026-07-10 16:45:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqclvcyrg72y...

CVE-2026-5136

creationtimestamp| type| source ---|---|--- 2026-07-01 22:37:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlehcflp22 2026-07-02 08:19:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnlvkzcfs2d 2026-07-02 19:38:27+00:00| seen|...

CVE-2026-53344

creationtimestamp| type| source ---|---|--- 2026-07-01 22:36:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlddysy32i...

CVE-2026-53339

creationtimestamp| type| source ---|---|--- 2026-07-01 22:35:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlas6til2y 2026-07-06 06:53:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53334

creationtimestamp| type| source ---|---|--- 2026-07-01 22:29:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkwsbrrn22...

CVE-2026-53340

creationtimestamp| type| source ---|---|--- 2026-07-01 22:26:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkrk2x5l2r...

CVE-2026-53336

creationtimestamp| type| source ---|---|--- 2026-07-01 22:20:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkge2c7o2y...

CVE-2026-50283

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId...

CVE-2026-50283 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId...

CVE-2026-50283

Craft CMS versions 5.0.0-RC1–5.9.20 and 4.0.0-RC1–4.17.13 contain an authorization issue in AssetsController::actionReplaceFile that can delete a source asset without source delete permission when both assetId and sourceAssetId are supplied. The runtime loads assetId ($assetToReplace) and sourceA...

CVE-2026-50283 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId...