Craft CMS Remote Code Execution via Signed Cookie

🕵️ RESEARCH & DEEP DIVES

• AI Security Spending Jumps as Fear Outpaces Proof of Value — Dark Reading

• djust has an authorization bypass on the WebSocket/SSE mount pathdjust provid... — CVE ThreatInt

• djust: Unsigned client state snapshot is restored as trusted view state (priv... — CVE ThreatInt

• djust: SSE sessions are not bound to the authenticated user; the client-chose... — CVE ThreatInt

• djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in ... — CVE ThreatInt

• Joi before 17.13.7 and 18.2.6 ReDoS via isoDatejoi (npm package joi, hapi.j... — CVE ThreatInt

• Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list BypassNodemailer befor... — CVE ThreatInt

• Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 CommentNo... — CVE ThreatInt

• Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContentNodemailer ... — CVE ThreatInt

• Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQLCraft CMS 5... — CVE ThreatInt

• Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code ExecutionCraft CMS ... — CVE ThreatInt

• Craft CMS before 4.18.6 Remote Code Execution via signed cookieCraft CMS 4.8.... — CVE ThreatInt

• Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via InstallerCraft... — CVE ThreatInt

• Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reor... — CVE ThreatInt

• n8n before 1.123.76 Improper Authorization via Source Control Pushn8n is a wo... — CVE ThreatInt

• n8n before 1.123.76 Sandbox Escape via Git Relative URLn8n is a workflow auto... — CVE ThreatInt

• AVideo through 29.0 Missing Authorization via comment API endpointAVideo thro... — CVE ThreatInt

• AVideo through 29.0 Missing Authorization Check via API Like EndpointAVideo t... — CVE ThreatInt

• AVideo through 29.0 Stored Cross-Site Scripting via User-Agent HeaderAVideo t... — CVE ThreatInt

• Architecting a secure landing zone in the AWS European Sovereign Cloud — AWS Security Blog

• By me: I wrote about how a data breach of 150+ million driver's licenses and their photos is a privacy and anonymity... — @zackwhittaker@mastodon.social

• The Hacker's Guide to Attacking AI Agents — r/netsec

• Tanium Asset SQL Injection (CVE-2026-86865) — thehackerwire.com (discovered)

• Enterprise at Scale: MCP’s Emerging Identity and Governance Foundation — securityboulevard.com (discovered)

• Podcast: The AI Harness That Never Checked Its Work: Absence of Evidence Isn’t Evidence of Absence — securityboulevard.com (discovered)