Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

CVE-2026-56852: Loop with Unreachable Exit Condition

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-42327: Improper Input Validation

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...