11675 matches found
CVE-2026-72826
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...
CVE-2026-72826 Grav before 1.0.13 Scope Bypass via createApiKey
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...
EUVD-2026-58638
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
EUVD-2026-58639
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...
CVE-2026-72825
The CVE affects getgrav/grav-plugin-api prior to 1.0.13. The ReportsController POST /reports/twig-content/allowlist enforces api.config.write then uses a bare isSuperAdmin() check instead of requireSuper(), causing an API key with scoped access to api.config.write minted on a super account to byp...
CVE-2026-72825 Grav before 1.0.13 API-key scope cap bypass via ReportsController
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...
CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
CVE-2026-72825
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
GO-2026-5284 vulnerabilities
Vulnerabilities for packages: minio-fips, minio...
GO-2023-2375 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GO-2022-1029 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2022-0615 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2026-5876 vulnerabilities
Vulnerabilities for packages: harvester-fips, harvester...
GO-2026-4513 vulnerabilities
Vulnerabilities for packages: flyte...
GO-2025-3811 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2024-3242 vulnerabilities
Vulnerabilities for packages: consul, consul-fips...
GO-2026-5105 vulnerabilities
Vulnerabilities for packages: act, flux, flux-image-automation-controller, mapotf, flux-source-controller-fips, snyk-cli, gitlab-rails-ce, skaffold, witness, grype-fips, pulumi-language-yaml, gitsign, syft-fips, k9s, gitlab-rails-ce-fips, argocd-image-updater, crossplane, chainctl-fips,...
GO-2026-4976 vulnerabilities
Vulnerabilities for packages: external-dns-fips, kubernetes-csi-node-driver-registrar-fips, flux, commercial-grafana, vcluster-fips, terraform-fips, trino, mattermost-fips, oauth2-proxy-fips, hubble, ld-relay-fips, kubernetes-dashboard, elastic-agent-fips, gitlab-rails-ce, harbor, juicefs,...
