https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:47:09.543049+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-365145 EUVD-2026-365145 2026-10-02T10:47:09.545094+00:00 EUVD-2026-365145 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86730 fkie_cve-2026-86730 2026-10-02T10:47:09.545124+00:00

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

 https://cve.radiocsirt.org/vuln/ghsa-j4wp-xfvq-c8f7 GHSA-j4wp-xfvq-c8f7 2026-10-02T10:47:09.545155+00:00

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().