{"api_version":"v1","generated_at":"2026-10-07T06:45:00+00:00","product":{"cve_count":118,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-craftcms-cms-38b18ddc546d","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/cms","name":"cms","next_cursor":"djE6NTA","observations":[{"affected":"cms: 5.0.0-RC1 < 5.11.0","affected_versions_present":true,"cve_id":"CVE-2026-92594","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92594","fixed":"cms: 5.11.0","last_modified":"2026-09-18T20:08:12.977Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-pcmv-c398-gc5m","primary_source":"","published":"2026-09-16T21:46:59.423Z"},{"affected":"cms: 5.10.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-92593","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92593","fixed":"cms: 5.10.13","last_modified":"2026-09-17T14:45:54.536Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-5jmw-g85v-7jv2","primary_source":"","published":"2026-09-16T21:46:58.692Z"},{"affected":"cms: 4.8.0 < 4.18.6, 5.0.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-92592","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92592","fixed":"cms: 4.18.6, 5.10.13","last_modified":"2026-09-17T19:23:31.247Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-5r92-75j8-c534","primary_source":"","published":"2026-09-16T21:46:57.949Z"},{"affected":"cms: 5.0.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-92591","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92591","fixed":"cms: 5.10.13","last_modified":"2026-09-17T13:26:27.358Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-hfjh-gw6x-7pv5","primary_source":"","published":"2026-09-16T21:46:57.263Z"},{"affected":"cms: 5.7.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-92590","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92590","fixed":"cms: 5.10.13","last_modified":"2026-09-19T02:04:23.960Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-h9jh-v8vc-m5rp","primary_source":"","published":"2026-09-16T21:46:56.556Z"},{"affected":"cms: 5.0.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-92589","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92589","fixed":"cms: 5.10.13","last_modified":"2026-09-18T20:12:02.490Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-6fp2-8j9w-7mj8","primary_source":"","published":"2026-09-16T21:46:55.216Z"},{"affected":"5.8.0 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-79987","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-79987","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-11T03:56:46.336Z","patch_url":"","primary_source":"","published":"2026-09-10T16:05:55.403Z"},{"affected":"5.0.0-RC1 < 5.10.12","affected_versions_present":true,"cve_id":"CVE-2026-86732","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-86732","fixed":"5.10.12","last_modified":"2026-09-10T13:54:12.753Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9wcj-wqqh-cqvg","primary_source":"","published":"2026-09-08T15:14:02.315Z"},{"affected":"cms: 5.0.0-RC1 < 5.10.12","affected_versions_present":true,"cve_id":"CVE-2026-86731","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-86731","fixed":"cms: 5.10.12","last_modified":"2026-09-19T14:21:56.253Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-jqf5-vfg6-8cx5","primary_source":"","published":"2026-09-08T15:14:01.558Z"},{"affected":"5.0.0-RC1 < 5.10.12","affected_versions_present":true,"cve_id":"CVE-2026-86730","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-86730","fixed":"5.10.12","last_modified":"2026-09-08T15:36:22.493Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj4v-m29p-fj4m","primary_source":"","published":"2026-09-08T15:14:00.853Z"},{"affected":"5.0.0-RC1 < 5.10.13","affected_versions_present":true,"cve_id":"CVE-2026-79991","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-79991","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-02T17:55:14.034Z","patch_url":"","primary_source":"","published":"2026-09-02T14:25:15.221Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-79990","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-79990","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-02T17:53:23.468Z","patch_url":"","primary_source":"","published":"2026-09-02T14:19:54.892Z"},{"affected":"5.0.0-RC1 < 5.10.8","affected_versions_present":true,"cve_id":"CVE-2026-79989","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-79989","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-02T17:51:42.963Z","patch_url":"","primary_source":"","published":"2026-09-02T14:11:02.784Z"},{"affected":"5.7.0 < 5.10.12","affected_versions_present":true,"cve_id":"CVE-2026-84802","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84802","fixed":"5.10.12","last_modified":"2026-09-02T12:40:15.581Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-5mjc-jqcw-6vrp","primary_source":"","published":"2026-09-02T11:11:16.346Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84801","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84801","fixed":"5.10.11","last_modified":"2026-09-02T16:00:54.541Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qw4-cjqw-fj72","primary_source":"","published":"2026-09-02T11:11:15.664Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84800","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84800","fixed":"5.10.11","last_modified":"2026-09-02T13:17:41.009Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-329j-cx85-8r56","primary_source":"","published":"2026-09-02T11:11:14.995Z"},{"affected":"5.0.0-RC1 < 5.11.0","affected_versions_present":true,"cve_id":"CVE-2026-84799","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84799","fixed":"5.11.0","last_modified":"2026-09-04T02:26:22.911Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-4w9w-3x96-7ghp","primary_source":"","published":"2026-09-02T11:11:14.295Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84798","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84798","fixed":"5.10.11","last_modified":"2026-09-02T15:39:44.479Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-5fh8-74j8-mvcp","primary_source":"","published":"2026-09-02T11:11:13.625Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84797","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84797","fixed":"5.10.11","last_modified":"2026-09-02T12:41:08.602Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-2f55-h4xr-92p2","primary_source":"","published":"2026-09-02T11:11:12.900Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84796","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84796","fixed":"5.10.11","last_modified":"2026-09-02T16:01:00.533Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-3wcr-p33w-528f","primary_source":"","published":"2026-09-02T11:11:12.215Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84795","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84795","fixed":"5.10.11","last_modified":"2026-09-02T13:20:00.698Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq","primary_source":"","published":"2026-09-02T11:11:11.270Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84794","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84794","fixed":"5.10.11","last_modified":"2026-09-04T02:25:35.585Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9xvf-7w97-83mv","primary_source":"","published":"2026-09-02T11:11:10.617Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84793","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84793","fixed":"5.10.11","last_modified":"2026-09-02T13:53:12.362Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf","primary_source":"","published":"2026-09-02T11:11:09.939Z"},{"affected":"5.0.0-RC1 < 5.10.11","affected_versions_present":true,"cve_id":"CVE-2026-84792","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-84792","fixed":"5.10.11","last_modified":"2026-09-02T12:43:16.441Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-ccpq-mw3m-wwg2","primary_source":"","published":"2026-09-02T11:11:09.282Z"},{"affected":"4.0.0-RC1 < 4.18.3; 5.0.0-RC1 < 5.10.7","affected_versions_present":true,"cve_id":"CVE-2026-79988","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-79988","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-08-28T16:51:38.368Z","patch_url":"","primary_source":"","published":"2026-08-27T15:36:18.188Z"},{"affected":"4.0.0-RC1 < 4.18.2; 5.0.0-RC1 < 5.10.6","affected_versions_present":true,"cve_id":"CVE-2026-78416","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-78416","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-08-26T20:59:03.683Z","patch_url":"","primary_source":"","published":"2026-08-24T15:36:07.971Z"},{"affected":"5.0.0-RC1 < 5.10.8","affected_versions_present":true,"cve_id":"CVE-2026-72787","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72787","fixed":"5.10.8","last_modified":"2026-08-14T16:51:58.377Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc","primary_source":"","published":"2026-08-12T19:07:36.918Z"},{"affected":"5.0.0-RC1 < 5.10.8","affected_versions_present":true,"cve_id":"CVE-2026-72786","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72786","fixed":"5.10.8","last_modified":"2026-08-14T16:51:57.728Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vc","primary_source":"","published":"2026-08-12T19:07:35.873Z"},{"affected":"5.0.0-RC1 < 5.10.6","affected_versions_present":true,"cve_id":"CVE-2026-72785","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72785","fixed":"5.10.6","last_modified":"2026-08-11T18:06:44.774Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq","primary_source":"","published":"2026-08-11T12:17:19.183Z"},{"affected":"5.0.0-RC1 < 5.10.6; 4.0.0-RC1 < 4.18.2","affected_versions_present":true,"cve_id":"CVE-2026-72784","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72784","fixed":"5.10.6; 4.18.2","last_modified":"2026-08-11T14:54:03.555Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-2mx8-9ww7-p27x","primary_source":"","published":"2026-08-11T12:17:18.509Z"},{"affected":"5.0.0-RC1 < 5.10.6; 4.0.0-RC1 < 4.18.2","affected_versions_present":true,"cve_id":"CVE-2026-72783","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72783","fixed":"5.10.6; 4.18.2","last_modified":"2026-08-14T19:51:58.185Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-7hxc-f267-h5q7","primary_source":"","published":"2026-08-11T12:17:17.772Z"},{"affected":"5.0.0-RC1 < 5.10.6; 4.0.0-RC1 < 4.18.2","affected_versions_present":true,"cve_id":"CVE-2026-72782","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72782","fixed":"5.10.6; 4.18.2","last_modified":"2026-08-11T17:50:10.062Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v","primary_source":"","published":"2026-08-11T12:17:17.101Z"},{"affected":"5.0.0-RC1 < 5.10.7; 4.0.0-RC1 < 4.18.3","affected_versions_present":true,"cve_id":"CVE-2026-72781","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72781","fixed":"5.10.7; 4.18.3","last_modified":"2026-08-11T14:01:32.931Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-f5wm-88jv-g5hx","primary_source":"","published":"2026-08-11T12:17:16.358Z"},{"affected":"5.0.0-RC1 < 5.10.5","affected_versions_present":true,"cve_id":"CVE-2026-72780","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72780","fixed":"5.10.5","last_modified":"2026-08-11T18:04:52.722Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8","primary_source":"","published":"2026-08-11T12:17:15.532Z"},{"affected":"5.0.0-RC1 < 5.10.6; 4.0.0-RC1 < 4.18.2","affected_versions_present":true,"cve_id":"CVE-2026-72779","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72779","fixed":"5.10.6; 4.18.2","last_modified":"2026-08-11T14:56:11.842Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw","primary_source":"","published":"2026-08-11T12:17:14.804Z"},{"affected":"5.0.0-RC1 < 5.10.6; 4.0.0-RC1 < 4.18.2","affected_versions_present":true,"cve_id":"CVE-2026-72778","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-72778","fixed":"5.10.6; 4.18.2","last_modified":"2026-08-14T19:53:02.701Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-265m-7826-wjqm","primary_source":"","published":"2026-08-11T12:17:14.099Z"},{"affected":">= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, <= 4.17.14","affected_versions_present":true,"cve_id":"CVE-2026-50282","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50282","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T18:01:27.543Z","patch_url":"","primary_source":"","published":"2026-07-02T16:15:25.823Z"},{"affected":">= 5.7.0, < 5.9.21","affected_versions_present":true,"cve_id":"CVE-2026-50281","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50281","fixed":"5.9.21.","last_modified":"2026-07-02T19:44:23.581Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-x5m4-g2cq-52pq","primary_source":"","published":"2026-07-02T16:02:14.029Z"},{"affected":">= 5.0.0-RC1, < 5.9.21","affected_versions_present":true,"cve_id":"CVE-2026-50280","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50280","fixed":"5.9.21.","last_modified":"2026-07-02T15:39:22.626Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-43cq-c2gq-pfpw","primary_source":"","published":"2026-07-01T23:43:49.095Z"},{"affected":">= 5.0.0-RC1, < 5.9.21","affected_versions_present":true,"cve_id":"CVE-2026-50279","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50279","fixed":"5.9.21.","last_modified":"2026-07-02T12:27:42.242Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qq2c-2q8j-jh27","primary_source":"","published":"2026-07-01T23:31:31.101Z"},{"affected":">= 5.9.0, < 5.10.0","affected_versions_present":true,"cve_id":"CVE-2026-55794","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55794","fixed":"5.10.0.","last_modified":"2026-07-02T12:41:39.752Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-f74w-488g-8x5r","primary_source":"","published":"2026-07-01T23:26:22.071Z"},{"affected":">= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0","affected_versions_present":true,"cve_id":"CVE-2026-55792","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55792","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T14:49:11.273Z","patch_url":"","primary_source":"","published":"2026-07-01T23:20:28.993Z"},{"affected":">= 5.0.0-RC1, < 5.10.0; >= 4.0.0-RC1, < 4.18.0","affected_versions_present":true,"cve_id":"CVE-2026-55791","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55791","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T15:54:26.284Z","patch_url":"","primary_source":"","published":"2026-07-01T23:13:58.321Z"},{"affected":">= 5.0.0-RC1, < 5.9.23; >= 4.0.0-RC1, < 4.17.16","affected_versions_present":true,"cve_id":"CVE-2026-55790","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55790","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T19:41:26.967Z","patch_url":"","primary_source":"","published":"2026-07-01T22:57:53.934Z"},{"affected":"=>= 5.0.0-RC1, < 5.9.22; >= 4.0.0-RC1, < 4.17.15","affected_versions_present":true,"cve_id":"CVE-2026-50284","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50284","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T12:46:04.509Z","patch_url":"","primary_source":"","published":"2026-07-01T22:37:30.334Z"},{"affected":">= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14","affected_versions_present":true,"cve_id":"CVE-2026-50283","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50283","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-02T14:47:28.384Z","patch_url":"","primary_source":"","published":"2026-07-01T22:20:01.949Z"},{"affected":">= 5.0.0-RC1, < 5.9.23","affected_versions_present":true,"cve_id":"CVE-2026-55793","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55793","fixed":"5.9.23.","last_modified":"2026-07-02T15:54:31.536Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xrqc-p465-2xvg","primary_source":"","published":"2026-07-01T21:57:58.440Z"},{"affected":"4.0.0-RC1 < 4.17.7; 5.0.0-RC1 < 5.9.13","affected_versions_present":true,"cve_id":"CVE-2026-56394","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-56394","fixed":"4.17.7; 5.9.13","last_modified":"2026-06-23T13:34:34.446Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp","primary_source":"","published":"2026-06-21T13:27:02.445Z"},{"affected":"5.0.0-RC1 < 5.9.0-beta.1; 4.0.0-RC1 < 4.17.0-beta.1","affected_versions_present":true,"cve_id":"CVE-2026-56393","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-56393","fixed":"5.9.0-beta.1; 4.17.0-beta.1","last_modified":"2026-06-22T13:22:05.584Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx","primary_source":"","published":"2026-06-21T13:27:01.755Z"},{"affected":"5.0.0-RC1 < 5.9.14; 4.0.0-RC1 < 4.17.8","affected_versions_present":true,"cve_id":"CVE-2026-56385","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-56385","fixed":"5.9.14; 4.17.8","last_modified":"2026-06-22T12:18:10.953Z","patch_url":"https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq","primary_source":"","published":"2026-06-21T13:27:01.066Z"}],"source_generated_at":"2026-10-06T06:22:27.870Z","vendor":"craftcms"}}