CVE-2026-113469

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

EUVD-2026-104841

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

CVE-2026-113469

The SNS is vulnerable to a logic error in its signature verification routine . This flaw allows the system to accept unauthenticated dynamic data updates during the Autoupdate routine . The vulnerability (CWE-287) can lead to high impacts on confidentiality , integrity , and availability (CVSS 3....

CVE-2026-113469 Improper Signature Verification of Active Update Files

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

PT-2026-118268

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

Arbitrary Code Injection

Grav is vulnerable to Arbitrary Code Injection. The vulnerability is due to incomplete validation of dynamic-data bare functions using a denylist instead of an allowlist, which allows an attacker with page-edit or blueprint-config access to invoke errorlog, write malicious PHP payloads to...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-68987

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488: Improper Neutralization of Input During Web Page Generation

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

GHSA-FWWX-3362-3947 Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...

Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

EUVD-2026-52439

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

PT-2026-67511

Name of the Vulnerable Software and Affected Versions Shlink versions 5.0.0 through 5.1.5 Description An issue exists where unauthenticated remote attackers can inject spreadsheet formulas into exported visit data. By sending a request to any short URL with malicious values in the User-Agent,...

Exploit for CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-...

CVE-2026-65608

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

PT-2026-61930

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6 Description Remote code execution is possible through the Blueprint::dynamicData function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its...

CVE-2026-1543

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...