Is craftcms/cms 5.10 vulnerable?
Composer · 15 releases from 5.10.0 to 5.10.14 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
No known advisories in the last release
craftcms/cms 5.10.14, the last 5.10 release, has no known advisories. 11 advisories affect earlier 5.10.x releases, so update to 5.10.14.
composer require craftcms/cms:^5.10.14Fixed within 5.10.x, affecting earlier releases
Craft CMS: Passkey login accepts replayed WebAuthn assertions
- Affected
- >=5.0.0-RC1 <5.10.5
- Fixed in
- 5.10.5
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
- Affected
- >=5.0.0-RC1 <5.10.6
- Fixed in
- 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Which of your client projects are still on craftcms/cms 5.10?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.