CVE-2026-72822

The getgrav/grav-plugin-api Composer package (versions ≤ 1.0.12) contains an authentication bypass on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermis...

CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

EUVD-2026-58636

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72812 SiYuan before v3.7.4 Missing Authorization via refreshBacklink

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

GO-2023-1704 vulnerabilities

Vulnerabilities for packages: go, kubeflow-katib...

GO-2025-3438 vulnerabilities

Vulnerabilities for packages: grafana-fips, grafana...

GO-2025-4110 vulnerabilities

Vulnerabilities for packages: virt-api, virt-handler, virt-operator, virt-launcher, docker-machine-driver-harvester, virt-handler-fips, virt-controller, virt-operator-fips, virt-controller-fips, virt-api-fips...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, helm-docs, harbor-fips, k8sgpt, flux-source-controller, consul-k8s, trivy, rancher-helm, flux-helm-controller-fips, flux, harbor, helm-push, kargo, k8ssandra-client-fips, eksctl, rancher-fleet, cilium-cli, chart-testing-fips, cerbos, linkerd2,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, helm-exporter, gitlab-operator-fips, gatekeeper, kyverno, rancher, rancher-helm, k8ssandra-client-fips, chaos-mesh, crossplane, opentofu, kubescape, k9s, cloudbeat, crossplane-fips, falcoctl, chartmuseum-fips, helm-mapkubeapis, opentofu-fips,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, dapr-fips, vault, amazon-cloudwatch-agent-fips, grafana-alloy, amazon-cloudwatch-agent, argo-events, vault-fips, dapr, cluster-api-aws-controller-fips, opentelemetry-collector-contrib, splunk-otel-collector-fips, sqlexporter-fips,...

GO-2023-2045 vulnerabilities

Vulnerabilities for packages: metrics-server...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, helm-operator, k8ssandra-client, tw, chart-testing, rancher-helm, cert-manager-cmctl, k9s, zot, helm-docs, flux, cluster-api-helm-controller, flux-source-controller, trivy, chartmuseum, helm-push, kots, kubescape, cilium-cli, zarf, pluto, eksctl...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, helm-operator, k8ssandra-client, tw, chart-testing, rancher-helm, cert-manager-cmctl, k9s, zot, helm-docs, cluster-api-helm-controller, rancher-fleet, flux-source-controller, k8sgpt, cerbos, trivy, chartmuseum, helm-push, kots, kargo, linkerd2,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: bento, opentelemetry-collector-contrib, splunk-otel-collector, jitsucom-bulker, argo-events, amazon-cloudwatch-agent, grafana-alloy, cluster-api-aws-controller, sqlexporter...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: karpenter, kiali, crossplane-provider-family-aws, terraform-docs, rancher-helm, atlantis, apisix-ingress-controller, cert-manager-webhook-pdns, crossplane-provider-azure-storage, rancher-webhook, src-fingerprint, guac, amazon-cloudwatch-agent-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: headlamp, crossplane-provider-family-aws, clickhouse-operator, lazygit, rancher-helm, k3d, gatekeeper, pgtimetable, src-fingerprint, guac, kine, amazon-cloudwatch-agent-operator, dkron, extism, crossplane-provider-aws-elasticache, boring-registry, podinfo,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: headlamp, clickhouse-operator, k3d, prometheus-operator, guac, amazon-cloudwatch-agent-operator, gcsfuse, tkn, argo-events, terraform-provider-azapi, oauth2-proxy, azure-service-operator, rancher-system-agent, nri-nginx, k8sgateway, docker-credential-gcr, docker-cli,...

EUVD-2026-58506

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...