https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:14:56.771591+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273330 EUVD-2026-273330 2026-10-05T11:14:56.774403+00:00 EUVD-2026-273330 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23209 fkie_cve-2025-23209 2026-10-05T11:14:56.774441+00:00

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

 https://cve.radiocsirt.org/vuln/ghsa-x684-96hh-833x GHSA-x684-96hh-833x — Craft CMS has a potential RCE with a compromised security key 2026-10-05T11:14:56.774494+00:00

Affected: Packagist: craftcms/cms

### Impact

This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised.

https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret

Anyone running an unpatched version of Craft with a compromised security key is affected.

### Patches

This has been patched in Craft 5.5.8 and 4.13.8.

### Workarounds

If you can't update to a patched version, then rotating your security key and ensuring its privacy will help to migitgate the issue.

### References

https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603