Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

### Summary The `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interfa

历史摘要 · 未重新核验 · GitHub Advisory

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

### Summary Special:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354) ### Details

历史摘要 · 未重新核验 · GitHub Advisory

Grav CMS vulnerable to remote code execution via .zip file upload

CVE-2026-72819

### Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

CVE-2026-75837

## Summary The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `secu

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

CVE-2026-75834

## Vulnerability Details **Component**: getgrav/grav core **File**: `system/src/Grav/Common/Security.php` **Function**:

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

CVE-2026-75827

## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Sinks: - `system/s

历史摘要 · 未重新核验 · GitHub Advisory

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

CVE-2026-75828

## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/sr

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

CVE-2026-74907

**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = "2.0.15"`, file `index.php ## Title Unauthenticated

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

CVE-2026-72695

# Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion ## Summary A path traversal vulnerab

历史摘要 · 未重新核验 · GitHub Advisory

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

CVE-2026-84997

### Summary A malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\Http\Io\ChunkedDecoder` into a

历史摘要 · 未重新核验 · GitHub Advisory

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CVE-2026-79752

### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd(

历史摘要 · 未重新核验 · GitHub Advisory

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

CVE-2026-72697

## Summary The `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`s

历史摘要 · 未重新核验 · GitHub Advisory

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

CVE-2026-76839

## Summary `system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Com

历史摘要 · 未重新核验 · GitHub Advisory

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

CVE-2026-76846

## Summary `system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `secu

历史摘要 · 未重新核验 · GitHub Advisory

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

CVE-2026-72698

## Summary `Grav\Common\Twig\Twig::init()` unconditionally puts the raw `system`, `site`, and `theme` config arrays int

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

CVE-2026-72701

## Summary `Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, comp

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

CVE-2026-58657

## Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media act

历史摘要 · 未重新核验 · GitHub Advisory

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

CVE-2026-61453

## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*

历史摘要 · 未重新核验 · GitHub Advisory

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

CVE-2026-59193

### Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archi

历史摘要 · 未重新核验 · GitHub Advisory

Shopper: Missing authorization on product removal actions in CollectionProducts component

CVE-2026-56825

## Title Missing authorization on product removal actions in CollectionProducts component ## Description A lack of au

历史摘要 · 未重新核验 · GitHub Advisory