CVE-2026-92592

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

PT-2026-94109

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.8.0 through 4.18.5 Craft CMS versions 5.0.0 through 5.10.12 Description An issue exists where the software signs an authenticated user's attacker-controlled license-shun cookie using the same key and format used to validat...

CVE-2026-86241

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86241

liufee FeehiCMS (up to 2.1.1 ) is affected by a hard-coded cryptographic key vulnerability in the Cookie Validation component, specifically in the file environments/prod/backend/config/main-local.php. Manipulation of the cookieValidationKey argument leads to use of a fixed key, allowing remote at...