Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Missing scope enforcement on disable2fa endpoint in getgrav/grav-plugin-api (CVE-2026-72822)
The grav-plugin-api Composer package fails to invoke requirePermission() on the admin (non-self) path of the disable2fa endpoint, meaning the api_key_scopes cap is never applied. A holder of a narrow-scope API key on ...
Fixed in 1.0.13
API key scope-cap bypass enabling SSTI in Grav API plugin (CVE-2026-72824)
The Grav API plugin's `PagesController::guardTwigContent()` enforces the Twig-toggle check with a bare `isSuperAdmin()` gate that never consults `api_key_scopes`. A least-privilege API key scoped only to `api.pages.wr...
Fixed in 1.0.13
API key scope escalation in Grav CMS plugin API (CVE-2026-72826)
The getgrav/grav-plugin-api plugin does not validate that scopes assigned to a newly created API key are a subset of the requesting caller's own scopes. An attacker with a minimal api.access-scoped key on a super acco...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin UsersController (CVE-2026-72829)
The Grav API plugin's UsersController create() and update() methods enforce the scope cap only for api.users.write but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly wi...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin enabling RCE (CVE-2026-72830)
The Grav API plugin's `ConfigController` enforces the API-key scope cap in only one location (`AbstractApiController::requirePermission()`), which is bypassed by super-scope gates that rely on a bare `isSuperAdmin()` ...
Fixed in 1.0.13
Classpath file disclosure via URL manipulation in Apache Tapestry (CVE-2026-61899)
A vulnerability in tapestry-core allows remote attackers to download classpath assets by sending specially crafted URLs. This exposes potentially sensitive files from the application classpath without authentication.
Fixed in 5.9.1
Authorization code injection in Apache CXF OpenID Connect Hybrid Flow (CVE-2026-57817)
Apache CXF fails to enforce validation of the `c_hash` (authorization code hash) parameter when operating in the OpenID Connect Hybrid Flow, contrary to the requirements of the OpenID Connect Core 1.0 specification. W...
Fixed in 4.2.3; 4.1.8; 3.6.12
Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. Attackers can exploit this flaw to execute...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier exposes Groovy scripting features that do not integrate with the Script Security Plugin, bypassing sandbox controls. Attackers with Item/Create or Item/Configure permiss...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
EncryptInterceptor bypass in Apache Tomcat (CVE-2026-34486)
An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed in Apache Tomcat, leaving sensitive data unencrypted in transit. This missing encryption of sensitive data poses a risk to deploymen...
Fixed in Apache Tomcat 11.0.21; Apache Tomcat 10.1.54; Apache Tomcat 9.0.117
Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid Proton Dotnet to trigger a StackOverflowError, potentially causing denial of service. No authentication is required to trigger this condi...
Fixed in 1.1.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67589)
A pre-authentication attacker can exploit improper type size/count handling in Apache Qpid ProtonJ2 to trigger excessive memory allocation, leading to potential denial of service. No authentication is required to expl...
Fixed in 1.2.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67588)
Apache Qpid ProtonJ2 contains a vulnerability in its symbol value caching mechanism that imposes no upper bound on cache growth. A pre-authentication attacker can exploit this to exhaust server resources, resulting in...
Fixed in 1.2.0
Pre-authentication stack overflow in Apache Qpid ProtonJ2 (CVE-2026-67590)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid ProtonJ2 to trigger a StackOverflowError, potentially causing denial of service. Because the vulnerability is reachable before authentica...
Fixed in 1.2.0
Uncontrolled resource consumption in Apache Qpid ProtonJ2 (CVE-2026-67592)
Apache Qpid ProtonJ2 did not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker could exploit this to cause excessive resource usage and potential denial of service.
Fixed in 1.2.0
Pre-authentication denial of service in Apache Qpid Proton-J (CVE-2026-66273)
Apache Qpid Proton-J contains a flaw in type size/count handling that allows a pre-authentication attacker to trigger excessive memory allocation. This can lead to a potential denial of service condition.
Fixed in 0.35.0
Pre-authentication resource exhaustion in Apache Qpid Proton-J (CVE-2026-66257)
Apache Qpid Proton-J contains a vulnerability in which symbol values are cached without bound, allowing a pre-authentication attacker to exhaust server resources. Successful exploitation results in denial of service.
Fixed in 0.35.0
Server-side file-write and request forgery via spatial lookups in Django (CVE-2026-15307)
Django's spatial lookups allowed `str` and `dict` lookup values to be passed to `GDALRaster` when they represented rasters. Depending on the raster driver, this could write a file to disk (in some cases enabling remot...
Fixed in Django 6.0.8; Django 5.2.17
Incorrect authorization for Parameter Context validation in Apache NiFi (CVE-2026-62354)
Apache NiFi incorrectly authorizes Parameter Context validation requests, allowing clients with only read access to submit proposed Parameter values that override current configuration. This enables read-only users to...
Fixed in Apache NiFi 2.11.0
Uncontrolled resource consumption via HTTP decompression in Apache NiFi (CVE-2026-68981)
Apache NiFi enforced its maximum request size limit on the compressed payload of gzip-encoded HTTP requests rather than on the decompressed output. A malicious client can exploit this to send crafted requests that con...
Fixed in Apache NiFi 2.11.0