Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

CVE-2026-42613

# Bug Report: Registration Privilege Escalation via Missing Server-Side Validation of groups/access ## Summary The `Lo

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

CVE-2026-42842

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field templat

历史摘要 · 未重新核验 · GitHub Advisory

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

CVE-2026-42841

### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attri

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

CVE-2026-42607

### Summary An authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a

历史摘要 · 未重新核验 · GitHub Advisory

Grav API Privilege Escalation to Super Admin

CVE-2026-42843

### Summary An insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allow

历史摘要 · 未重新核验 · GitHub Advisory

phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

CVE-2026-44167

### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patch

历史摘要 · 未重新核验 · GitHub Advisory

Kimai vulnerable to formula Injection via tag names in XLSX export

CVE-2026-42267

## Summary Any `ROLE_USER` can create a tag with a formula string as its name (e.g. `=SUM(54+51)`) via `POST /api/tags`

历史摘要 · 未重新核验 · GitHub Advisory

Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

CVE-2026-42207

## Summary `Mage_ProductAlert_AddController::stockAction()` reads the uenc query parameter and passes it directly to `$t

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has an incomplete fix for CVE-2026-32812 (SSRF)

CVE-2026-42194

### Summary The incomplete SSRF fix in Admidio's `fetch_metadata.php` validates the resolved IP address but passes the

历史摘要 · 未重新核验 · GitHub Advisory

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

CVE-2026-42155

Affected Version: OpenMage LTS ≤ 20.16.0 (confirmed on `20.16.0`) Affected File: `https://github.com/OpenMage/magento-l

历史摘要 · 未重新核验 · GitHub Advisory

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

## Summary `OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments.

历史摘要 · 未重新核验 · GitHub Advisory

livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler

### Impact All versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file u

历史摘要 · 未重新核验 · GitHub Advisory

phpVMS has an /importer authorization bypass causing full database wipe

CVE-2026-42569

# Security Advisory: Unauthenticated Access to Legacy Import Feature **Severity:** Critical **Affected versions:** phpV

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

## Summary The `cleanUpString()` method in `ConfigWriter.php` uses an ungreedy regex to strip Liquidsoap string interpo

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

## Summary The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middle

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

## Summary The `/api/internal/{station_id}/liquidsoap/{action}` endpoint is accessible from the public web interface be

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

CVE-2026-42606

## Summary The `ApplyXForwarded` middleware unconditionally trusts the client-supplied `X-Forwarded-Host` HTTP header w

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

CVE-2026-42605

## Summary The `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_i

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS has a Deactivated User Session Bypass (active=0)

CVE-2026-41891

### Summary The auth filter has the deactivated/banned user check commented out. ### Details CodeIgniter Shield's `log

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess

CVE-2026-41890

### Summary The `deleteProcess()` action accepts a POST parameter `tables[]` containing arbitrary table names. These are

历史摘要 · 未重新核验 · GitHub Advisory