https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T08:46:11.078741+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-237704 EUVD-2026-237704 2026-10-16T08:46:11.081322+00:00 EUVD-2026-237704 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46731 fkie_cve-2025-46731 2026-10-16T08:46:11.081359+00:00

Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.

 https://cve.radiocsirt.org/vuln/ghsa-7c58-g782-9j38 GHSA-7c58-g782-9j38 — Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI 2026-10-16T08:46:11.081399+00:00

Affected: Packagist: craftcms/cms

Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Note: This is a follow-up to https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv

Users should update to the patched versions (4.14.13 and 5.6.15) to mitigate the issue.

### References https://github.com/craftcms/cms/pull/17026