Hackrate Kft. — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by Hackrate Kft. (hackrate). https://vulnogram.org/seaview/icons/hackrate.png Hackrate Kft. — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT CVE-2026-105985 · 8.8 HIGH — Authenticated RCE via render-components Entry Type overrides https://vulnogram.org/CVE-2026-105985 https://vulnogram.org/CVE-2026-105985 Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property o… High Tue, 06 Oct 2026 10:23:25 GMT CVE-2026-79987 · 8.8 HIGH — Low-privilege RCE through element-search eager loading https://vulnogram.org/CVE-2026-79987 https://vulnogram.org/CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker. High Thu, 10 Sep 2026 16:05:55 GMT CVE-2026-79991 · 7.1 HIGH — Authenticated SQL Injection via nested eager-loading criteria https://vulnogram.org/CVE-2026-79991 https://vulnogram.org/CVE-2026-79991 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the G… High Wed, 02 Sep 2026 14:25:15 GMT CVE-2026-79990 · 8.7 HIGH — GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete https://vulnogram.org/CVE-2026-79990 https://vulnogram.org/CVE-2026-79990 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the G… High Wed, 02 Sep 2026 14:19:54 GMT CVE-2026-79989 · 8.7 HIGH — Arbitrary user password reset leading to administrator account takeover https://vulnogram.org/CVE-2026-79989 https://vulnogram.org/CVE-2026-79989 The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit… High Wed, 02 Sep 2026 14:11:02 GMT CVE-2026-79988 · 8.7 HIGH — Authenticated RCE through Twig sandbox escape https://vulnogram.org/CVE-2026-79988 https://vulnogram.org/CVE-2026-79988 The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities. High Thu, 27 Aug 2026 15:36:18 GMT CVE-2026-78416 · 8.7 HIGH — Authenticated RCE via `condition.config` JSON cleanse bypass https://vulnogram.org/CVE-2026-78416 https://vulnogram.org/CVE-2026-78416 Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii beh… High Mon, 24 Aug 2026 15:36:07 GMT CVE-2026-2345 · 3.6 LOW — Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers https://vulnogram.org/CVE-2026-2345 https://vulnogram.org/CVE-2026-2345 Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal me… Low Wed, 11 Feb 2026 14:49:44 GMT