68 matches found
CVE-2026-109325
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
CVE-2026-109315
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...
EUVD-2026-97627
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
CVE-2026-109325
The Grav CMS (versions 2.0.22 through 2.1.7) contains an authentication bypass vulnerability within the Clockwork profiler component. The root cause is that the profiler trusts loopback REMOTE_ADDR values, allowing unauthenticated attackers positioned behind a same-host HTTP proxy to bypass secur...
CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
EUVD-2026-97617
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...
CVE-2026-109315
The Grav CMS (versions 2.0.22 before 2.1.7 ) is susceptible to an information disclosure vulnerability due to an oversight in the Twig sandbox redaction list, which omits system.debugger.token . This allows page editors to render the Clockwork debugger token through editor-authored Twig. An attac...
CVE-2026-109315 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...
CVE-2026-92916
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
EUVD-2026-81438
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
CVE-2026-92916
Grav, a flat-file CMS, is affected by an unauthenticated information disclosure in versions 1.7.0–1.7.53.2 and 2.0.0–2.0.21 when the debugger is enabled (system.debugger.enabled: true, not the default). The Clockwork profiler endpoint (/__clockwork/) is intercepted during bootstrap without any au...
CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
CVE-2026-92916: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...
PT-2026-94239
Name of the Vulnerable Software and Affected Versions Grav versions 1.7.0 through 1.7.53.2 Grav versions 2.0.0 through 2.0.21 Description When the debugger is enabled via system.debugger.enabled: true, the Clockwork profiler endpoint is exposed without authentication. The...
EUVD-2017-8931
Malware in sbrugna...
EUVD-2023-55576
Malicious code in bioql PyPI...
