Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)
Grav's default .htaccess and reference webserver-configs/htaccess.txt contain rules blocking HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) that lack the [NC] (No Case) flag, rendering ext...
Fixed in 2.0.4
Authorization bypass in Grav API plugin (CVE-2026-62231)
The Grav API plugin (getgrav/grav-plugin-api) contains an authorization bypass in which API keys created with a restricted scopes array are never enforced by the ApiKeyAuthenticator class. The authenticator loads and ...
Fixed in 1.0.6
Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An atta...
Fixed in 2.0.4
Privilege escalation in Grav Plugin API (CVE-2026-62233)
grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit t...
Fixed in 1.0.6
Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme ...
Fixed in 2.0.4
SQL injection in OpenRemote datapoint export (CVE-2026-62238)
OpenRemote contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names into raw SQL without adequate escapi...
Fixed in 1.26.0
JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)
The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the...
Fixed in 1.0.0-rc.16
Overly permissive CORS in Grav API plugin (CVE-2026-62387)
The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attack...
Fixed in 1.0.0-rc.16
Hardcoded JWT secret and authentication bypass in clawvet API server (CVE-2026-62241)
The clawvet self-hosted API server (apps/api) hard-codes a fallback JWT signing secret ('clawvet-dev-secret-change-me') in source and ships the same value as the default in .env.example. The GET /api/v1/scans endpoint...
Fixed in 0.7.5
Path traversal in Wazuh Manager agent enrollment (CVE-2026-39359)
CVE-2026-39359 is an unauthenticated path traversal vulnerability in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). A logic flaw allows agents to supply a group name containing ".....
Fixed in 4.10.4; 4.14.5
Heap buffer overflow in Wazuh manager rootcheck parsing (CVE-2026-34150)
CVE-2026-34150 is a heap buffer overflow in wazuh-analysisd affecting the Wazuh manager's rootcheck event parsing function W_JSON_ParseRootcheck, where a 30-byte heap buffer is written to without bounds checking via s...
Fixed in >= 4.14.5
Server Side Template Injection (SSTI) in Jupyter Enterprise Gateway (CVE-2026-44181)
CVE-2026-44181 is a Server Side Template Injection (SSTI) vulnerability in Jupyter Enterprise Gateway affecting the rendering of Kubernetes manifest environment variables (`KERNEL_XXX`). An attacker can inject Jinja2 ...
Fixed in 3.3.0
YAML injection in jupyter-server/enterprise_gateway (CVE-2026-44182)
CVE-2026-44182 is a YAML injection vulnerability in jupyter-server/enterprise_gateway affecting Kubernetes manifest rendering via Jinja2 templates. The server interpolates untrusted `KERNEL_XXX` environment variables ...
Fixed in 3.3.0
Denial-of-service in Quicly QUIC protocol implementation (CVE-2026-44435)
Quicly, an IETF QUIC protocol implementation for use within the H2O HTTP server, contains a denial-of-service vulnerability in which an assertion failure is raised when the total number of valid handshake messages rec...
Fixed in commit 8b178e6 and above
Denial of Service in Quicly (CVE-2026-44436)
CVE-2026-44436 is a Denial of Service vulnerability in Quicly, an IETF QUIC protocol implementation used primarily within the H2O HTTP server. The library's packet decoder accepts Connection IDs of up to 255 bytes whi...
Fixed in commit 8b178e6 and above
Arbitrary method call in Kirby's REST API search (CVE-2026-44174)
CVE-2026-44174 is an arbitrary method call vulnerability in Kirby's REST API search and collection query endpoints. Affected releases did not validate model attributes used in collection queries, allowing authenticate...
Fixed in 4.9.1; 5.4.1
Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-44175)
CVE-2026-44175 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the list field and list block components. Insufficient HTML sanitization on save allows an authenticated Panel user with updat...
Fixed in 4.9.1; 5.4.1
Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-45368)
CVE-2026-45368 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the `(link: …)` KirbyTag, the `link:` parameter of the `(image: …)` KirbyTag, the built-in image block with a link, and the HT...
Fixed in 4.9.1; 5.4.1
Improper input validation in Zoom Desktop and VDI Client for Windows (CVE-2026-53412)
CVE-2026-53412 is a critical improper input validation vulnerability (CVSS 9.8) in Zoom Desktop Client for Windows and Zoom VDI Client for Windows. An unauthenticated attacker with network access may exploit this vuln...
Fixed in Zoom Workplace for Windows 7.0.0; Zoom Workplace VDI Client for Windows 7.0.10; 6.6.15; 6.5.18
TOCTOU race condition in Zoom Workplace VDI Plugin for Windows (CVE-2026-53411)
CVE-2026-53411 is a time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of the Zoom Workplace VDI Plugin for Windows, which the vendor additionally characterizes as an I...
Fixed in 6.6.14