CVE-2026-72825 Grav before 1.0.13 API-key scope cap bypass via ReportsController

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

GO-2026-5284 vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

GO-2023-2375 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2022-0615 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2022-1029 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2026-5876 vulnerabilities

Vulnerabilities for packages: harvester-fips, harvester...

GO-2026-4513 vulnerabilities

Vulnerabilities for packages: flyte...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2024-3242 vulnerabilities

Vulnerabilities for packages: consul, consul-fips...

GO-2026-5105 vulnerabilities

Vulnerabilities for packages: chainloop-cli, crossplane, steampipe, mapotf-fips, packer, trivy-operator-fips, act, grype, flux-fips, terragrunt, zarf, flux-source-controller-fips, gomplate, chainctl-fips, guac, kubescape-server, flux-image-automation-controller, pulumi-language-java, gitaly-fips,...

GO-2026-4976 vulnerabilities

Vulnerabilities for packages: jaeger, kube-state-metrics, telegraf, apm-server-fips, net-kourier-fips, knative-kafka-broker, longhorn-backing-image-manager, runc, aactl, chisel-fips, knative-net-istio, nvidia-nsight-compute-13.1, flux-fips, helm, kubernetes-csi-node-driver-registrar-fips,...

GO-2026-4681 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines...

GO-2023-1986 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2022-0209 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2023-1702 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, go...

GO-2025-4110 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GO-2025-3940 vulnerabilities

Vulnerabilities for packages: atlantis...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, scorecard, src-fingerprint, sops, stern, gke-gcloud-auth-plugin, kustomize, newrelic-prometheus-configurator, vault-k8s, cadvisor, cert-exporter, oras, runc, docker-credential-acr-env, src, prometheus-alertmanager, influx,...