CVE-2026-105694

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694

The open-source design and prototyping platform Penpot is vulnerable to Stored XSS in versions prior to 2.18.0 . Authenticated users with file-edit permission can upload SVG media containing unsanitized scripts, event-handler attributes, and foreignObject elements. Because these files are served ...

EUVD-2026-92713

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

PT-2026-106215

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Authenticated users with file-edit permissions can upload SVG media containing scripts, event-handler attributes, and foreignObject elements that are stored without sanitization and served as...

CVE-2026-105694: Improper Neutralization of Input During Web Page Generation

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

CVE-2023-50459

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

CVE-2026-84432

Concrete CMS versions 9 through 9.5.2 are affected by a CSRF vulnerability in the Boards custom slot dialog controller (custom_slot.php), specifically the saveTemplate() action. The action did not validate an anti-CSRF token, gating only on the canEditBoardContents() permission. A crafted cross-s...

PT-2026-89565

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/custom slot.php saveTemplate action. The action created a board slot proxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165: Improper Neutralization of Directives in Dynamically Evaluated Code

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

EUVD-2026-42992

Snipe-IT vulnerable to stored XSS via Markdown custom field...

GHSA-CRRC-VPP2-F5X7 Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...