1170 matches found
CVE-2026-66003
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0 , an access control bypass in the REST API allows a low-privileged authenticated user to read data from Linked DocTypes they are not authorized to access. The root cause is that when a doc...
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...
EUVD-2026-65212
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
Astra Linux – Vulnerability in libjettison-java
Those who use Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to out-of-memory conditions. This vulnerability could potentially allow for...
Astra Linux – Vulnerability in libjettison-java
A stack overflow in Jettison prior to v1.5.2 allowed attackers to cause a Denial of Service DoS attack through crafted JSON data...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter consumes significant memory when dealing with a string representation of a number in scientific notation with a large exponent...
Astra Linux – Vulnerability in python-pymysql
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input, because keys are not escaped by escapedict...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, kubernetes-csi-external-snapshotter, fluent-operator, kapp-controller, zot, calico, hubble, kwok, hubble-ui, helm-operator, metallb, cilium, cert-manager, cluster-api-ipam-provider-in-cluster, kube-metrics-adapter, cass-operato...
CVE-2026-56860 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, juicefs-csi-driver, chisel, istio, direnv, loki, portieris, verticadb-operator, crossplane-provider-aws-firehose, atlantis, hubble, cadvisor, kubernetes-dashboard-api, nginx-prometheus-exporter, sftpgo-plugin-auth, hubble-ui,...
GO-2026-6218 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, juicefs-csi-driver, chisel, istio, direnv, loki, portieris, verticadb-operator, crossplane-provider-aws-firehose, atlantis, hubble, cadvisor, kubernetes-dashboard-api, nginx-prometheus-exporter, sftpgo-plugin-auth, hubble-ui,...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
GO-2026-5575 vulnerabilities
Vulnerabilities for packages: kyverno, kyverno-notation-aws-fips, kyverno-notation-aws...
GO-2025-3652 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws...
GO-2026-5371 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws...
GO-2026-5374 vulnerabilities
Vulnerabilities for packages: kyverno, kyverno-fips, kyverno-notation-aws-fips, kyverno-notation-aws...