# Craft vulnerabilities Source: https://junglewise.ai/threats/vendors/craft Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/craft.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 51 vulnerabilities in Craft: 9 in the last 7 days and 43 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115934, was published on 9 November 2026. 21 vulnerabilities in the last four weeks, up 200% on the four before (7). 2 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 9 - Last 30 days: 18 - Last 90 days: 43 - All time: 51 (4 critical, 0 exploited in the wild) ## About Craft Craft is a content management system and platform for building digital experiences. ## Latest Craft vulnerabilities - [CVE-2026-115934: Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of) (critical, CVSS 9.8, published 9 Nov 2026) - [CVE-2026-124431: Craft CMS authorization bypass in volume browser](https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-124429: Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege) (high, CVSS 7.5, published 8 Nov 2026) - [CVE-2026-124428: Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2026-124427: Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization) (critical, CVSS 9.8, published 8 Nov 2026) - [CVE-2026-124426: Craft CMS authorization bypass in GraphQL localized field](https://junglewise.ai/threats/cve-2026-124426-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization) (medium, CVSS 5.3, published 8 Nov 2026) - [CVE-2026-123491: Craft CMS SQL injection in GraphQL eager-loading](https://junglewise.ai/threats/cve-2026-123491-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains) (high, CVSS 8.2, published 6 Nov 2026) - [CVE-2026-123490: Craft CMS privilege escalation via getOwners() sandbox bypass](https://junglewise.ai/threats/cve-2026-123490-craft-cms-from-5-8-17-before-5-11-2-contains-a-privilege) (high, CVSS 8.8, published 6 Nov 2026) - [CVE-2026-123488: Craft CMS SQL injection in element search endpoint](https://junglewise.ai/threats/cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-115938: Craft CMS template injection in element search](https://junglewise.ai/threats/cve-2026-115938-craft-cms-allows-any-authenticated-control-panel-user-to-submit) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-115937: Craft Commerce Mollie webhook parameter validation bypass](https://junglewise.ai/threats/cve-2026-115937-the-mollie-webhook-endpoint-accepts-two-independent-attacker) (high, CVSS 7.5, published 23 Oct 2026) - [CVE-2026-115935: Craft CMS privilege escalation via API response header injection](https://junglewise.ai/threats/cve-2026-115935-the-app-process-api-response-headers-action-accepts-fake-craft) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-112777: Craft CMS blocklist bypass in Twig create() function](https://junglewise.ai/threats/cve-2026-112777-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a) (high, CVSS 7.2, published 19 Oct 2026) - [CVE-2026-112775: Craft CMS verification code reuse allows account takeover](https://junglewise.ai/threats/cve-2026-112775-craft-cms-from-5-0-0-before-5-11-0-contains-an-authentication) (high, CVSS 7.5, published 19 Oct 2026) - [CVE-2026-112774: Craft CMS authenticated admin RCE via ContentBlock field-layout](https://junglewise.ai/threats/cve-2026-112774-craft-cms-from-5-8-0-before-5-11-0-contains-a-remote-code) (high, CVSS 7.2, published 19 Oct 2026) - [CVE-2026-112773: Craft CMS Twig sandbox escape and remote code execution](https://junglewise.ai/threats/cve-2026-112773-craft-cms-from-5-0-0-before-5-11-0-contains-a-remote-code) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-112771: Craft CMS Twig sandbox allowlist bypass via array filters](https://junglewise.ai/threats/cve-2026-112771-craft-cms-4-0-0-before-4-18-8-and-5-0-0-before-5-11-0-contains-a) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-112770: Craft CMS Twig group filter remote code execution](https://junglewise.ai/threats/cve-2026-112770-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-109308: Craft CMS behavior injection RCE in AppController::actionCacheUpdates](https://junglewise.ai/threats/cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109307: Craft CMS DOM-based cross-site scripting in 2FA verification](https://junglewise.ai/threats/cve-2026-109307-craft-cms-5-0-0-before-5-10-14-contains-a-dom-based-cross-site) (medium, CVSS 4.7, published 12 Oct 2026) - [CVE-2026-109305: Craft CMS Twig sandbox bypass in "has some"/"has every" operators](https://junglewise.ai/threats/cve-2026-109305-craft-cms-from-5-10-2-before-5-10-14-contains-a-twig-sandbox) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109304: Craft CMS arbitrary file read via Twig create() DOMDocument](https://junglewise.ai/threats/cve-2026-109304-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-contains) (medium, CVSS 4.9, published 12 Oct 2026) - [CVE-2026-105985: Craft CMS authenticated remote code execution in Control Panel](https://junglewise.ai/threats/cve-2026-105985-craft-cms-5-10-13-2-contains-an-authenticated-remote-code) (high, CVSS 8.8, published 6 Oct 2026) - [CVE-2026-92594: Craft CMS GraphQL authorization bypass in draftCreator and revisionCreator fields](https://junglewise.ai/threats/cve-2026-92594-craft-cms-graphql-authorization-bypass-in-draftcreator-and) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-92593: Craft CMS authenticated server-side template injection](https://junglewise.ai/threats/cve-2026-92593-craft-cms-authenticated-server-side-template-injection) (high, CVSS 8.8, published 16 Sep 2026) ## Most severe Craft vulnerabilities - [CVE-2026-84795: Craft CMS privilege escalation via admin flag inheritance in user registration](https://junglewise.ai/threats/cve-2026-84795-craft-cms-privilege-escalation-via-admin-flag-inheritance-in-user) (critical, CVSS 9.8, published 2 Sep 2026) - [CVE-2026-115934: Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of) (critical, CVSS 9.8, published 9 Nov 2026) - [CVE-2026-124427: Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization) (critical, CVSS 9.8, published 8 Nov 2026) - [CVE-2026-123488: Craft CMS SQL injection in element search endpoint](https://junglewise.ai/threats/cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-72778: Craft CMS authenticated remote code execution in element-search condition](https://junglewise.ai/threats/cve-2026-72778-craft-cms-authenticated-remote-code-execution-in-element-search) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-72781: Craft CMS remote code execution via Twig sandbox escape](https://junglewise.ai/threats/cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-86730: Craft CMS behavior injection in field-layout elements](https://junglewise.ai/threats/cve-2026-86730-craft-cms-behavior-injection-in-field-layout-elements) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-92592: Craft CMS authenticated remote code execution via signed-cookie confusion](https://junglewise.ai/threats/cve-2026-92592-craft-cms-authenticated-remote-code-execution-via-signed-cookie) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-92593: Craft CMS authenticated server-side template injection](https://junglewise.ai/threats/cve-2026-92593-craft-cms-authenticated-server-side-template-injection) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-109308: Craft CMS behavior injection RCE in AppController::actionCacheUpdates](https://junglewise.ai/threats/cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes) (high, CVSS 8.8, published 12 Oct 2026) ## Vulnerabilities per week 21 vulnerabilities in the last four weeks, up 200% on the four before (7). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 10 | 1 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 6 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 9 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 8 | 2 | 0 | | 9 Nov 2026 | 1 | 1 | 0 | ## Craft technologies - [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1): 28 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Craft vulnerabilities", https://junglewise.ai/threats/vendors/craft, 12 November 2026.