PT-2026-40829

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.4.0 Description An information disclosure issue exists where the 'GET /v1/onboarding/config' endpoint leaks infrastructure secrets in plaintext to unauthenticated users. This occurs specifically when the...

CVE-2026-44011

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled...

CVE-2026-44011

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled...

CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled...

CVE-2026-44011

Craft CMS versions 4.0.0–4.17.11 and 5.0–5.9.17 contain an input-handling flaw in a Yii object creation path that lets an authenticated user inject malicious configuration and execute arbitrary commands. The issue arises because the request-controlled field layouts data is converted into a live F...

CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41293 Source advisory: OSV:GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43513 Source advisory: OSV:GHSA-5MP6-JRQ3-R938...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43514 Source advisory: GHSA-9M89-8FRQ-C98C...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.54), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.54)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-41293 Source advisory: OSV:GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43512 Source advisory: OSV:GHSA-H6FC-48RJ-7QQH...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41293 Source advisory: GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +12 more potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=8.5.2, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =8.5.2, =9.0.31, =3.3.6, =3.3.6, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =5.21.0, =5.20.0, =8.0.0, =10.0.1 Source cves: CVE-2026-41293 Source advisory: GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43514 Source advisory: OSV:GHSA-9M89-8FRQ-C98C...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43512 Source advisory: GHSA-H6FC-48RJ-7QQH...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-43512 Source advisory: OSV:GHSA-H6FC-48RJ-7QQH...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-43514 Source advisory: OSV:GHSA-9M89-8FRQ-C98C...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43515 Source advisory: OSV:GHSA-5M62-PW8W-7W9F...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41284 Source advisory: OSV:GHSA-GX5V-XP9W-J4CG...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-42498 Source advisory: GHSA-FV25-8XCX-GQJC...