CVE-2026-109308: Craft CMS 4.0.0
- Severity
- 8.7 (HIGH)
- Vendor
- CRAFT CMS
- Affected versions
- Before 4.18.7
- Fixed version
- 4.18.7
- Patch status
- Patched
- Published
- 2026-10-12T17:17:25.227
- Modified
- 2026-10-12T17:17:25.227
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
Technical summary
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.
View the official NVD record for CVE-2026-109308
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
872 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-89111 |
The SAP Cloud SDK for Python
Reporter: CNA
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97229 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-65162 |
NVIDIA AIStore for Linux
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-85947 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85948 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85955 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77366 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96012 |
IBM Db2 Mirror for i 7.4, 7.5, and 7.6
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96119 |
IBM
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89107 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89110 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-57118 |
PraisonAI PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109575 |
Data Plane API EE PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-90920 |
IBM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87689 |
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-53709 |
MCP Context Forge is an MCP gateway and administrative platform PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85956 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-9191 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82101 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82103 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82110 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-109705 |
MOZILLA PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-109707 |
MOZILLA PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-104192 |
Dragonfly is an in-memory data store built for modern application workloads PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-108929 |
NR268
Reporter: CNA
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63350 |
the user’s browser session and perform PLC operations
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63353 |
Affected devices do not properly sanitize comment fields contained in imported trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63354 |
imported CSV trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-74040 |
Wazuh PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-74041 |
Wazuh 4.14.3 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-92681 |
@neo4j/graphql PATCH
Reporter: 3B236295-4CCD-4A1F-A1C1-A72EECC8D7B6
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108907 |
NR268
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109321 |
Grav Login OAuth plugin (grav-plugin-login-oauth) PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109372 |
ZITADEL 4.x PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108917 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108918 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2025-71429 |
GPT-SoVITS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109566 |
Rapyd Admin from 9.0.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109569 |
sandboxed.sh
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-44828 |
Qexo PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109758 |
a Node.js 24/Express deployment
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109109 |
WL-WN530BE1-A
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109110 |
WL-WN592AX6
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109520 |
iGameCenter
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77099 |
Commvault Cloud PATCH
Reporter: 050066FD-A2F9-4F32-AB5D-4C53F48BC333
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109391 |
Squash
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109399 |
SWUpdate
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109238 |
Crawl4AI 0.7.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109357 |
LibreNMS PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109373 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109422 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37279 |
easy-pdf-merge 0.1.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109573 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109394 |
Thirty bees
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-87744 |
A flaw was found in Quarkus REST Data Panache. This vulnerability
Reporter: SECALERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108362 |
ra-tls-clients PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-109423 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-53997 |
Netherman Portal del Hermano (portaldelhermano.es) PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-89108 |
SAP
Reporter: CNA
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-65173 |
NVIDIA AIStore for Linux
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-49483 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-44415 |
SIEMENS
Reporter: PRODUCTCERT
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-109371 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-77363 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105464 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105465 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-57143 |
praisonaiagents PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2021-48012 |
fast-toml
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84313 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84316 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84317 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84318 |
nginx-ui PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102627 |
IBM TRIRIGA Application Platform 5.0.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19620 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19622 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82096 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82108 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89113 |
SAP Commerce Cloud does not sufficiently validate certain user-supplied input
Reporter: CNA
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-103418 |
MOZILLA PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102073 |
Product identification pending
Reporter: PRODUCTCERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109709 |
MOZILLA PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109756 |
MOZILLA PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109778 |
MOZILLA PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-12655 |
ROCKWELLAUTOMATION
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109398 |
Gumlet php-image-resize PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109305 |
Craft CMS from 5.10.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109308 |
Craft CMS 4.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109318 |
Grav Git Sync 1.0.2
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109325 |
Grav from 2.0.22 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109326 |
Grav PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109359 |
Contrast 1.8.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109363 |
ZcashFoundation Zebra 6.4.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2020-37280 |
cbor-sync
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48011 |
Servor 1.0.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109380 |
modern-tar 0.3.5
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109563 |
N3.js PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18529 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18537 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-84314 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58390 |
Frappe PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.