160660 matches found
keycloak v26.7.4
Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...
santa v2026.8
Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...
Grav CMS vulnerable to remote code execution via .zip file upload
Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...
GHSA-R94F-HX44-8JQF Grav CMS vulnerable to remote code execution via .zip file upload
Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...
GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...
GHSA-JQ29-C7V8-RG55 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...
GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...
GHSA-47CH-6W46-6XM7 Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...
GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...
GHSA-P597-CRQC-M349 Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...
GHSA-9CCQ-2JFG-QW33 Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
On August 23rd, 2026, Wordfence Argus, our AI research agent specializing in complex vulnerability chains, discovered a PHP Object Injection vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites. This vulnerability allows any authenticated attacker with...
Security Bulletin: jackson-databind-2.21.2.jar
Summary IBM Db2 Developer Extension uses jackson-databind, which is vulnerable to multiple security issues including polymorphic type validator bypass CVE-2026-54512, CVE-2026-54513, server-side request forgery via DNS resolution CVE-2026-54514, improper @JsonIgnore enforcement CVE-2026-54515,...