CVE•Published 2026-08-27•Modified 2026-09-09•0 articles on news•4 live references•NVD data

CVE-2026-54713

Vulnerability data via NVD (ingested)

CVSS v3.1

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS percentile

Exploit Prediction Scoring System · top 71% of all CVEs

Weaknesses (CWE)

CWE-1023Incomplete Comparison with Missing Factors

Description

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Timeline

Published 2026-08-27

Modified 2026-09-09

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-54713

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-54713

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-54713

Censys host search filtered to this CVE id.

grep.app

CVE-2026-54713