Veille CVE

Semaine du 24 août au 30 août 2026

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « craftcms cms » ✕
  1. CVE-2026-79988 8.7 Élevée

    craftcms cms

    The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

  2. CVE-2026-78416 8.7 Élevée

    craftcms cms

    Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.