109 matches found
CVE-2026-113897
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox...
CVE-2026-113897
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox...
EUVD-2026-110322
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox...
CVE-2026-113897
A vulnerability in the Web Content sandbox allows a remote attacker to potentially perform a sandbox escape . This issue was addressed by removing the vulnerable code. The fix is available in Safari 27.2 , iOS 27.2 , iPadOS 27.2 , macOS Golden Gate 27.2 , and visionOS 27.2 . No specific details r...
Apple Safari security vulnerabilities
A security vulnerability exists in Apple Safari versions prior to 27.2, Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, and Apple visionOS versions prior to 27.2. This vulnerability stems from a flaw in the Web Content Sandbox...
PT-2026-125347
Name of the Vulnerable Software and Affected Versions Safari versions prior to 27.2 iOS versions prior to 27.2 iPadOS versions prior to 27.2 macOS Golden Gate versions prior to 27.2 visionOS versions prior to 27.2 Description A remote attacker may be able to break out of the Web Content sandbox,...
AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1748626479)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748626479 advisory. - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS...
CVE-2026-100668
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...
CVE-2026-100668
Grav versions 2.0.0 through 2.0.24 are vulnerable to a Twig content sandbox escape due to the array filter being registered without the necessary needs_is_sandboxed guard. This allows an attacker capable of authoring Twig content to evaluate grav|array to access the raw Pimple-based dependency in...
CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...
CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...
CVE-2026-100668
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The "array" filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray ...
CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...
CVE-2026-100668: Exposure of Sensitive Information to an Unauthorized Actor
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...
CVE-2026-92917
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...
PT-2026-94240
Name of the Vulnerable Software and Affected Versions Grav versions 2.0.0-rc.1 through 2.0.21 Description The Twig content sandbox fails to restrict dump and serialize filters, specifically print r, vardump, json encode, yaml encode, and string. This occurs because the...
CVE-2026-92917: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...
CVE-2026-61842
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...
CVE-2026-61842: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...
