CVE-2026-76921 Use After Free in Wireshark

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76921

A use-after-free vulnerability in Wireshark's CMS protocol dissector affects versions 4.6.0–4.6.7 and 4.4.0–4.4.18. A crafted packet triggers the crash, causing denial of service (CVSS 5.5, MEDIUM). No in-the-wild exploitation is reported. Users should upgrade to patched Wireshark releases; see t...

CVE-2026-76921

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76881

Wireshark's CMS protocol dissector crashes via a null pointer dereference in versions 4.6.0–4.6.7 and 4.4.0–4.4.18, enabling denial of service. CVSS 4.7 (MEDIUM) requires local access and user interaction. Fix: upgrade to 4.6.8 or 4.4.19 per wnpa-sec-2026-76. No exploitation details provided.

CVE-2026-76881 NULL Pointer Dereference in Wireshark

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-s3 versions 23.0.4...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

EUVD-2026-63102

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

Regular Expression Denial of Service (ReDoS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the regexReplace process. An attacker can exhaust server resources and cause denial of service b...

CVE-2026-64852

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user c...

CVE-2026-62667

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user c...

CVE-2026-62667 Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

CVE-2026-62667 Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

EUVD-2026-62538

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...

CVE-2026-61607

In Grav API plugin versions prior to 1.0.2, HandlesMediaUploads::processUploadedFile() validates only the SVG filename extension without calling Security::sanitizeSVG(), allowing an attacker with api.media.write permission to upload an SVG with embedded JavaScript. The server serves it as Content...

CVE-2026-52889

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...

CVE-2026-52889

Formie (a Craft CMS plugin) versions 3.0.0-beta.1 through 3.1.26 are vulnerable to Server-Side Template Injection (SSTI) . The root cause is in Hidden::getFrontEndInputOptions(), which assigns request-derived Hidden field defaults (HTTP User Agent, Referer URL, Current URL, Query Parameter, Cooki...

CVE-2026-52889 Formie: Server-Side Template Injection in Formie Hidden field defaults

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...