1233 matches found
CVE-2026-72698
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...
PT-2026-81141
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16 Description Sandboxed Twig renders fail to filter system, site, and theme configuration arrays. This allows users with page-content edit access to read sensitive configuration values, such as cache credentials...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: node-feature-discovery, kyverno, emissary, flux-kustomize-controller, tkn, apisix-ingress-controller, azure-service-operator, cloud-provider-azure, cluster-api-azure-controller, fluent-operator, kubescape, k3s, caddy, gitlab-kas, external-secrets-operator, openbao,...
CVE-2026-56860 vulnerabilities
Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...
GO-2026-6218 vulnerabilities
Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...
Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
GO-2025-3652 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws...
GO-2026-5575 vulnerabilities
Vulnerabilities for packages: commercial-kyverno, kyverno-notation-aws-fips, kyverno, kyverno-notation-aws...
GO-2026-5594 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws, commercial-kyverno, kyverno-notation-aws-fips, kyverno-fips, kyverno...
GO-2026-5371 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws...
GO-2026-5374 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno, kyverno-fips, kyverno-notation-aws...
GO-2026-4382 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno, kyverno-fips, kyverno-notation-aws...
GO-2026-5351 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno, kyverno-fips, kyverno-notation-aws...
GO-2025-3823 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws...