[HIGH] Craft CMS has a potential RCE with a compromised security key

PKSA-nfqr-ns8g-wkkx CVE-2025-23209 GHSA-x684-96hh-833x

Affected version: >=4.0.0-RC1,<4.13.8|>=5.0.0-RC1,<5.5.5

Reported by:
GitHub

[HIGH] Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

PKSA-xh7q-jwpn-v1cd CVE-2024-56145 GHSA-2p6p-9rc9-62j9

Affected version: >=3.0.0,<3.9.14|>=4.0.0-RC1,<4.13.2|>=5.0.0-RC1,<5.5.2

Reported by:
GitHub

[HIGH] Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

PKSA-4wwj-2m42-9pp5 CVE-2024-52293 GHSA-f3cw-hg6r-chfv

Affected version: >=5.0.0-RC1,<=5.4.2|>=4.0.0-RC1,<=4.12.1

Reported by:
GitHub

[HIGH] Craft CMS Arbitrary System File Read

PKSA-jkbm-w624-yb7q CVE-2024-52292 GHSA-cw6g-qmjq-6w2w

Affected version: >=3.5.13,<=4.12.6.1|>=5.0.0-alpha.1,<=5.4.7.1

Reported by:
GitHub

[HIGH] Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

PKSA-mtjx-x487-29s9 CVE-2024-52291 GHSA-jrh5-vhr9-qh7q

Affected version: >=4.0.0-RC1,<=4.12.4.1|>=5.0.0-RC1,<=5.4.5.1

Reported by:
GitHub

[MEDIUM] Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

PKSA-8qn2-9hhy-cmx1 CVE-2024-45406 GHSA-28h4-788g-rh42

Affected version: >=5.0.0,<5.1.2

Reported by:
GitHub

[MEDIUM] Craft CMS Allows TOTP Token To Stay Valid After Use

PKSA-56qm-r9zg-vprk CVE-2024-41800 GHSA-wmx7-pw49-88jx

Affected version: >=5.0.0-beta.1,<=5.2.2

Reported by:
GitHub