1264 matches found
CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...
CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...
CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...
Information Exposure
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the Twig rendering process. An attacker can access sensitive configuration values by leveraging page-content edit...
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
PT-2026-81141
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16 Description Sandboxed Twig renders fail to filter system, site, and theme configuration arrays. This allows users with page-content edit access to read sensitive configuration values, such as cache credentials...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, spicedb, openbao, k3s, tetragon, cluster-api-gcp-controller, cluster-api, cert-manager, emissary, kube-metrics-adapter, gitlab-kas, kyverno, azure-service-operator, cluster-api-helm-controller, metrics-server, kube-rbac-proxy, kubeflow-pipelines,...
CVE-2026-56860 vulnerabilities
Vulnerabilities for packages: kaf, nri-elasticsearch, kubernetes-replicator, nri-consul, renovate, git-lfs, opencost, crossplane-provider-aws-cloudfront, cadvisor, nfs-subdir-external-provisioner, rclone, tekton-pipelines, pvc-autoresizer, certificate-transparency, external-dns, tfsec,...
GO-2026-6218 vulnerabilities
Vulnerabilities for packages: kaf, nri-elasticsearch, kubernetes-replicator, nri-consul, renovate, git-lfs, opencost, crossplane-provider-aws-cloudfront, cadvisor, nfs-subdir-external-provisioner, rclone, tekton-pipelines, pvc-autoresizer, certificate-transparency, external-dns, tfsec,...
Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
GO-2026-5268 vulnerabilities
Vulnerabilities for packages: commercial-kyverno, kyverno-notation-aws-fips, kyverno-notation-aws...
GO-2026-5594 vulnerabilities
Vulnerabilities for packages: kyverno, kyverno-notation-aws, commercial-kyverno, kyverno-fips, kyverno-notation-aws-fips...
GO-2026-5337 vulnerabilities
Vulnerabilities for packages: kyverno, kyverno-notation-aws, commercial-kyverno, kyverno-fips, kyverno-notation-aws-fips...