https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 13:22:12 +0000 https://cve.radiocsirt.org/vuln/cve-2026-56382 <p><strong>Affected:</strong> craftcms cms</p> <p>Craft CMS (composer package craftcms/cms) versions &gt;= 5.5.0 and &lt;= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., &#39;on init&#39; keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.</p> <p><strong>Affected:</strong> craftcms cms</p> <p>Craft CMS (composer package craftcms/cms) versions &gt;= 5.5.0 and &lt;= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., &#39;on init&#39; keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.</p> https://cve.radiocsirt.org/vuln/cve-2026-56382