EUVD-2026-65220

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in its Twig sandbox configuration. Attackers with page-edit permission can leverage config.get() or config.toArray() within Twig templates to exfiltrate sensitive system configuration secrets (e.g., system.cache.redis.password) when confi...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

kern

kern: um runtime rápido e sem root para sandbox e recursos virtuais, para qualquer carga de trabalho, incluindo código não confiável e gerado por IA. Um contêiner real, imposto pelo kernel, em 3.5 ms, a partir de um único binário de 1.52 MB sem daemon. 0 RAM em repouso · sem daemon, sem socket,...

RHEL 8 : webkit2gtk3 (RHSA-2026:59326)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59326 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

PT-2026-81795

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in WebGL, where a remote attacker can execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML page. Use after fre...

PT-2026-81792

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in Aura allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a...

PT-2026-81801

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An out of bounds read occurs in the GPU component, which allows a remote attacker to read memory outside the sandbox by using a specially crafted HTML page. An out of bounds...

PT-2026-81826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in DevTools allows a remote attacker to execute arbitrary code inside the sandbox. This is achieved by leveraging social engineering and a crafted Chrome extensio...

PT-2026-81834

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in ANGLE allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory...

PT-2026-81844

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in Aura allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory...

PT-2026-81781

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An uninitialized resource in Dawn allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-81663

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper state validation in the Performance component allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-81836

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description A use-after-free issue exists in ANGLE, which occurs when software continues interacting with memory after it has been released. This memory-corruption flaw allows a remote...

PT-2026-81694

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Dawn allows a remote attacker to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome t...

PT-2026-81823

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in Extensions allows a remote attacker to execute arbitrary code inside the sandbox by sending crafted network traffic. A race condition occurs when the timing or order...