CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...

CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

CVE-2026-72830

Grav API plugin versions prior to 1.0.13 are vulnerable to remote code execution due to a failure to enforce API key scope caps in ConfigController super-scope gates. While requirePermission() correctly enforces caps, the scheduler and backups gates utilize a bare isSuperAdmin() check that ignore...

CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...

CLSA-2026-1771808253 TuxCare security update for symfony/process (1 CVE)

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p2+tuxcare...

CLSA-2026-1771894663 TuxCare security update for symfony/process (2 CVEs)

TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 4.4.44-p1+tuxcare...

CLSA-2026-1771894652 TuxCare security update for symfony/process (1 CVE)

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...

CLSA-2025-1761785574 TuxCare security update for symfony/process (1 CVE)

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p1+tuxcare...

CLSA-2025-1761785573 TuxCare security update for symfony/process (1 CVE)

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p1+tuxcare...

CLSA-2026-1772498780 TuxCare security update for symfony/process (2 CVEs)

TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 3.4.47-p1+tuxcare...

CVE-2026-28695

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...

CVE-2026-28695

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...

CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...

CVE-2026-28695

Summary of CVE-2026-28695 : Craft CMS 5.8.21 is vulnerable to an authenticated RCE via Server-Side Template Injection using the Twig create() function to trigger a Symfony Process gadget chain. The create() function exposes Craft::createObject(), enabling instantiation of arbitrary PHP classes wi...

CVE-2026-28695

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...

CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...

CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft is a content management system CMS. There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. The create Twig function exposes Craft::createObject, which allows instantiation of...