PT-2026-78470

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa cancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2025-49848

An Out-of-bounds Write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data...

CVE-2025-49848

An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data...

CVE-2025-49848

creationtimestamp| type| source ---|---|--- 2025-06-17 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02 2025-06-17 19:02:49+00:00| seen| Telegram/iY1e4d35r5DuMD6xVc0zCjzUfsszbqmNzOIDQdgMzjjccfQ...