CVE-2026-114660

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

CVE-2026-114636

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code. id: CVE-2022-3236 info: name: Sophos Firewall = 19.0 MR1 - Remote Code Execution author: daffainfo severity: critical...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive informatio...

CVE-2026-114660 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

CVE-2026-114660

The Grav content management system (versions 2.0.0 before 2.2.5) is vulnerable to an improper access control issue in the FlexDirectory::dynamicFlexField() function. This flaw allows page authors to execute arbitrary Flex object methods using flex-*@ directives within page frontmatter. If a user ...

EUVD-2026-107902

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

CVE-2026-114660 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

CVE-2026-114660

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

EUVD-2026-107891

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

CVE-2026-114636

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

CVE-2026-84910 Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5...

CVE-2026-84910 Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5...

CVE-2026-84910

The Drupal Advanced Search module (versions 0.0.0 to 2.4.5 ) is vulnerable to a Missing Authorization issue (CWE-862) leading to Forceful Browsing . The root cause is that the module fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX e...

CVE-2026-84910 Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5...

CVE-2026-84912 AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8...

CVE-2026-84913 AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1...

CVE-2026-84913 AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1...

CVE-2026-84912

The Drupal AI module is affected by a Missing Authorization vulnerability (CWE-862) in the AI Translate submodule. The root cause is insufficient access checks on entities, related fields, or referenced entities during the AI translation process, particularly when these components have different ...