26272 matches found
CVE-2026-72828
Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...
CVE-2026-72828
Grav Plugin API before 1.0.13 (grav-plugin-api) is affected by CVE-2026-72828: InvitationsController fails to enforce API-key scope caps. strip-super and accept-groups checks rely on isSuperAdmin() instead of scope-aware permissions, allowing a least-privilege API key scoped to api.users.write (i...
EUVD-2026-58638
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...
CVE-2026-72823
The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...
Incorrect Authorization
org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...
GO-2023-1840 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1839 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1842 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1841 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2025-3564 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2025-3567 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2024-2428 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2026-4419 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2025-3568 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2025-3566 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2026-4417 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
GO-2026-4423 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...