awesome-cybersecurity-resources

awesome-cybersecurity-resources Awesome Cybersecurity Resources, more. Purpose This repository stores curated cybersecurity resources gathered from the internet, repository documentation, and selected local notes. README.md is the resource catalog and source of truth. Each entry contains a headin...

obsidian-note-toolbar-PoC

Frontmatter-Driven Arbitrary Code Execution in Note Toolbar via propNAME → js: Variable Chain CVE status: requested, pending assignment. This finding is published as GHSA-q8cw-3m8c-5pf2. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-obsidian-note-toolbar-PoC and this banner is...

CVE-2026-116019

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

EUVD-2026-109277

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

CVE-2026-116019 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

CVE-2026-116019

The Grav CMS (versions 2.0.15 before 2.2.13) is susceptible to an allowlist bypass vulnerability. This flaw allows users with page-edit permissions to invoke arbitrary public static methods by relocating data-*@ directives using unset-name@ or integer keys . By embedding crafted fields in Flex fo...

CVE-2026-114659

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules...

CVE-2026-114658

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the...

EUVD-2026-107901

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules...

EUVD-2026-107900

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the...

CVE-2026-112781

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

CVE-2026-112781

The Grav CMS (versions 2.0.0 before 2.2.2 ) is vulnerable to an information disclosure flaw. The issue stems from the ability of users with page-edit permissions to add config-*@ directives to page frontmatter forms. This allows them to bypass the Twig sandbox config_denied_paths redaction, poten...

CVE-2026-112781 Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

EUVD-2026-104587

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

CVE-2026-112781 Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

CVE-2026-112781: Exposure of Sensitive Information to an Unauthorized Actor

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

PT-2026-117632

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.0 through 2.2.1 Description An information disclosure issue exists where users with page-edit permissions can read protected configuration data. This is achieved by adding config-@ directives to page frontmatter forms, which...

CVE-2026-86016

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = pmetaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can...

CVE-2026-86016 VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = pmetaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can...

CVE-2026-86016

VNote, a note-taking platform, contains a Stored XSS vulnerability in versions prior to 4.3.0 . The root cause is located in src/data/extra/web/js/markdownit.js, where the application assigns p_metaData to preNode.innerHTML before the protectFromXss sanitization path executes. This allows an atta...