Threat Intelligence Database

CVE-2026-14794 is a medium severity vulnerability in Craft CMS versions 4.18.0.0 and 4.18.0.1. It involves improper authorization in the actionGetNewUsersData function within the ChartsController.php file of the Charts Endpoint component. The flaw allows remote attackers to manipulate the userGroupId argument, potentially bypassing authorization controls. The issue is resolved by upgrading to version 4.18.1.

CVE-2026-14793 is an authorization bypass vulnerability in Craft CMS affecting versions 4.18.0.0 and 4.18.0.1. The issue exists in the actionReorderSets function of the GlobalsController.php file, specifically in the reorder-sets endpoint. This vulnerability allows remote attackers to bypass authorization controls. Upgrading to version 4.18.1 addresses this issue.

Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.

Pagekit CMS version 1.0.18 has a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves. This occurs due to missing authorization checks in the UserApiController::saveAction() method. Exploiting this flaw, attackers can grant themselves a custom role with the 'system: manage packages' permission, enabling them to upload and install malicious PHP packages via the admin package installer, potentially leading to remote code execution.

Craft CMS versions 5.5.0 through 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method. This flaw allows an authenticated admin user to inject Yii2 event handlers via the fieldLayoutConfig POST parameter, leading to arbitrary PHP code execution and potential disclosure of sensitive information such as environment variables and security keys. The vulnerability is fixed in version 5.9.14.

A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.