266181 matches found
CVE-2026-72827
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...
CVE-2026-72827 Grav CMS before 2.0.13 Remote Code Execution via Twig
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...
CVE-2026-72824
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
CVE-2026-72824
The CVE-2026-72824 entry details a vulnerability in the Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13. Root cause: PagesController::guardTwigContent() uses a bare isSuperAdmin() gate that does not consult api_key_scopes, allowing a least-privileged API key scoped to api.pages.write (m...
CVE-2026-72819
Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...
EUVD-2026-58633
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-72819
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
Exploit for CVE-2020-9373
CVE-2020-9373 – Netgear R6400 UPnP upnpd stack overflow vuln...
GO-2025-3777 vulnerabilities
Vulnerabilities for packages: prometheus-podman-exporter, prometheus-podman-exporter-fips...
GHSA-HHRP-GW25-JR43 vulnerabilities
Vulnerabilities for packages: lmcache-cuda-12.8...
GO-2023-1547 vulnerabilities
Vulnerabilities for packages: helm...
GO-2025-4150 vulnerabilities
Vulnerabilities for packages: grafana-fips, grafana...
GO-2025-3988 vulnerabilities
Vulnerabilities for packages: gitea, gitea-fips, sftpgo...
GO-2026-5675 vulnerabilities
Vulnerabilities for packages: dgraph...
GO-2025-4109 vulnerabilities
Vulnerabilities for packages: docker-machine-driver-harvester...
GO-2023-2068 vulnerabilities
Vulnerabilities for packages: croc...
GO-2023-2072 vulnerabilities
Vulnerabilities for packages: croc...
GO-2026-5617 vulnerabilities
Vulnerabilities for packages: ko-fips, portieris-fips, nrdot-collector-k8s-fips, vault, kubedock-fips, nerdctl-fips, envoy-gateway, trivy, skopeo, podman, harvester, ko, nerdctl, elastic-agent, docker-credential-gcr, opentelemetry-operator, commercial-grafana, upwind-agent, nuclei,...
