cakephp vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 202614

Newest CVEs

• CVE-2026-119419

  CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

  cakephp · cakephp

  Critical9.2
• CVE-2026-119418

  CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

  cakephp · cakephp

  Critical9.2
• CVE-2026-119417

  CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

  cakephp · cakephp

  Medium6.3
• CVE-2026-119416

  CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

  cakephp · cakephp

  Medium6.3
• CVE-2026-119415

  CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

  cakephp · cakephp

  Medium6.3
• CVE-2026-79752

  CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

  cakephp · cakephp

  Critical9.2
• CVE-2026-54713

  CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

  cakephp · queue

  Low3.7
• CVE-2026-54614

  DebugKit: MailPreview contains unsafe reflection

  cakephp · debug_kit

  Medium4.3
• CVE-2026-77337

  CakePHP: Potential Authentication bypass with CookieAuthenticator

  cakephp · authentication

  Critical9.1
• CVE-2026-77634

  CakePHP: SmtpTransport vulnerable to CRLF header injection

  cakephp · cakephp

  High8.2