CLSA-2026-1791989783 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 4.18.9-p1+tuxcare...

CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...

PT-2026-105398

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...

PT-2026-98329

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 4.18.7-p1+tuxcare...

CLSA-2026-1788430341 TuxCare security update for craftcms/cms (4 CVEs)

TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare...

PT-2026-90914

TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare...

CLSA-2026-1786625623 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...

PT-2026-80152

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...

CLSA-2026-1784077481 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

CLSA-2026-1783386121 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

PT-2026-75317

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

PT-2026-75422

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

PT-2026-75378

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p5+tuxcare...

PT-2026-74105

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

PT-2026-74443

TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 3.9.15-p2+tuxcare...

PT-2026-74562

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-75570

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare...

CVE-2026-56382: Improper Control of Generation of Code

Craft CMS composer package craftcms/cms versions = 5.5.0 and = 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization in the assets/preview-file. An attacker can access unauthorized preview metadata by sending crafted requests with a controlled assetId parameter, allowing retrieval of...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the getTokenRoute function. An attacker can bypass token usage limits by sending concurrent requests before the database update completes,...