https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T11:56:35.713284+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41129 CVE-2026-41129 — Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations 2026-10-17T11:56:35.721457+00:00

Affected: craftcms cms

Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the <VolumeName> volume" and "Create assets in the <VolumeName> volume." Versions 4.17.9 and 5.9.15 patch the issue.