EUVD-2026-71999

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86197 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86197 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86197

Grav versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the Twig sandbox policy . The addJs and addCss methods on Grav\Common\Assets are allowlisted without proper output escaping, allowing page editors to inject arbitrary script by registering malicious assets or inject...

CVE-2026-86194 Grav Form Plugin before 9.1.22 Cross-Page Form Execution

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-86194

CVE-2026-86194 affects the Grav Form Plugin before version 9.1.22 . The vulnerability is a cross-page form execution flaw: the plugin fails to verify page authorization when resolving forms by name across pages. As a result, anonymous visitors can POST to any public page using the name of a form ...

EUVD-2026-71996

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-86194 Grav Form Plugin before 9.1.22 Cross-Page Form Execution

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

EUVD-2026-72009

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188

AVideo installations with the YPTSocket plugin enabled are affected by an unauthenticated cross-site scripting (XSS) vulnerability. Attackers can send crafted WebSocket messages whose callback names resolve to global functions such as avideoConfirmHTML, which assign untrusted data to innerHTML, e...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174

Plane (project management platform) through version 1.4.2 has a validation flaw in its public deploy-board comment endpoint . The endpoint fails to verify that a supplied issue_id belongs to the deploy board's own project, allowing authenticated attackers to post comments to arbitrary issues acro...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

EUVD-2026-71973

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...