CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...

CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

gitgalaxy — Updated!

GitGalaxy Docs · Visualizer 1 scan · 97 structural signals · 50+ languages · 0 need for compilation 19 risk exposure scores · 6 final reports · 0 dependencies · pip install gitgalaxy What Pain Point Does This Solve? GitGalaxy exists for one recurring problem: understanding a large, real,...

checkov v3.3.9

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

CVE-2026-69088: Improper Control of Generation of Code

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

hexora v0.3.1

hexora Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code. It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign. It can be used to: Audit project...

pkgxray v1.0.5

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

zizmor v1.29.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

opentaint analyzer/2026.08.01.a8995a6

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

Apkx-Hunter v2.6.0

APKX-Hunter v2.7.1 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...

DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows ...

DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

CVE-2026-14483

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...