10316 matches found
CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
CVE-2026-84792
Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...
CVE-2026-78141
creationtimestamp| type| source ---|---|--- 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9751b736-8bb9-4c37-8b98-397276c88a36 2026-09-03 01:02:36+00:00| exploited|...
ECHO-F292-4A07-579C
Bulletin has no description...
MINI-FHRM-7VC7-263F
Bulletin has no description...
CVE-2026-82918
creationtimestamp| type| source ---|---|--- 2026-09-02 04:48:54+00:00| seen| https://jvn.jp/en/vu/JVNVU98062224...
CVE-2026-84310
creationtimestamp| type| source ---|---|--- 2026-09-02 03:31:51+00:00| seen| https://gist.github.com/alon710/3521e58613b990dddef5bf0335b08c88...
CVE-2026-84351
creationtimestamp| type| source ---|---|--- 2026-09-02 00:40:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117198658318645016 2026-09-02 04:47:04+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260902 2026-09-04 04:45:26+00:00| seen|...
PT-2026-84745
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...
CVE-2023-40288
creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:46+00:00| seen| https://t.me/hackingAttack/121668 2026-09-02 01:01:06+00:00| seen| https://t.me/hackingAttack/121668 2026-09-04 03:00:03+00:00| seen| https://t.me/hackingAttack/121668 2026-09-05 01:00:42+00:00| seen|...
MINI-67H2-RV4P-J3VM
Bulletin has no description...
MINI-C7FV-GCWJ-6QW2
Bulletin has no description...
MINI-8MMX-H3H4-63CX
Bulletin has no description...
MINI-5GV5-X2G8-XJ69
Bulletin has no description...
CVE-2026-73553
A flaw was found in Envoy. A remote, unauthenticated attacker can exploit this vulnerability to bypass access controls and reach protected backend endpoints. When path parameter stripping is enabled, Envoy strips parameters prior to routing requests but evaluates Role-Based Access Control RBAC...