490114 matches found
MINI-4678-XH8V-WWXH
Bulletin has no description...
CVE-2026-63408
In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...
CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...
MINI-32FH-JR8R-XV9F
Bulletin has no description...
MINI-RWQR-QX3W-46R9
Bulletin has no description...
MINI-MMMQ-HPHG-9QXP
Bulletin has no description...
MINI-4G62-2847-HF9M
Bulletin has no description...
MINI-CFX5-2PCQ-QXMH
Bulletin has no description...
MINI-J3JG-33FX-7359
Bulletin has no description...
MINI-H3FW-M2P7-G82V
Bulletin has no description...
MINI-RX8J-X243-6FX3
Bulletin has no description...
MINI-H36G-6WP8-WVWH
Bulletin has no description...
MINI-JFF2-GCV7-W24R
Bulletin has no description...
MINI-WMPJ-HC4P-776V
Bulletin has no description...
CVE-2026-62670
CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...
CVE-2026-45272
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...
CGA-85RJ-G5PX-XXG4
Bulletin has no description...
MINI-GH8G-R39X-8VXW
Bulletin has no description...