CVE-2026-42841

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...

CVE-2026-44738

Technical details are not publicly available in the provided documents. Monitor for updates from authoritative sources for affected software, version, and remediation.

CVE-2026-44738 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets...

CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

Unity Linux 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-017591)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017591 advisory. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to...

PT-2026-39647

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-rc.2 Description The Twig sandbox allow-list permits any user with the admin.pages role to call the config.toArray function from within a page body. This action dumps the entire merged site configuration into the...

openSUSE 16 Security Update : frr (openSUSE-SU-2026:20682-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20682-1 advisory. Security issues: - CVE-2025-61099: NULL Pointer Dereference in FRRouting bsc1252838. - CVE-2025-61100: NULL Pointer Dereference in FRRouting...

Debian dsa-6262 : liblcms2-2 - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6262 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6262-1 [email protected]...

CVE-2025-21739 affecting package kernel for versions less than 6.6.137.1-2

CVE-2025-21739 affecting package kernel for versions less than 6.6.137.1-2. A patched version of the package is available...

CVE-2026-31704 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31704 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-43243 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-43243 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-31694 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31694 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-23442 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-23442 affecting package kernel for versions less than 6.6.137.1-2. A patched version of the package is available...

CVE-2026-31696 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31696 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-31697 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31697 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-23399 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-23399 affecting package kernel for versions less than 6.6.137.1-2. A patched version of the package is available...

CVE-2026-43058 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-43058 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-31705 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31705 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-43195 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-43195 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...