45 matches found
Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms
CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RC...
CVE-2026-72830
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...
CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
CVE-2026-72830
Grav API plugin versions prior to 1.0.13 are vulnerable to remote code execution due to a failure to enforce API key scope caps in ConfigController super-scope gates. While requirePermission() correctly enforces caps, the scheduler and backups gates utilize a bare isSuperAdmin() check that ignore...
EUVD-2026-58644
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
CVE-2026-72830
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...
PT-2026-71999
Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...
CLSA-2026-1771894652 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...
CLSA-2026-1771894663 TuxCare security update for symfony/process (2 CVEs)
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 4.4.44-p1+tuxcare...
CLSA-2026-1771808253 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p2+tuxcare...
CLSA-2025-1761785573 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p1+tuxcare...
CLSA-2025-1761785574 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p1+tuxcare...
CLSA-2026-1772498780 TuxCare security update for symfony/process (2 CVEs)
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 3.4.47-p1+tuxcare...
PT-2026-73779
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p2+tuxcare...
PT-2026-73786
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...
PT-2026-73844
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 3.4.47-p1+tuxcare...
PT-2026-73599
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p1+tuxcare...