index.html Aktuelle CVEs, bekannte Exploits und wichtige Cybersecurity-Meldungen. de-DE Tue, 18 Aug 2026 13:03:48 +0000 https://euvd.enisa.europa.eu/enisa/EUVD-2026-60381 euvd:EUVD-2026-60381 Tue, 18 Aug 2026 12:37:02 +0000 EUVD Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60551 euvd:EUVD-2026-60551 Tue, 18 Aug 2026 12:30:43 +0000 EUVD An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components https://euvd.enisa.europa.eu/enisa/EUVD-2026-60549 euvd:EUVD-2026-60549 Tue, 18 Aug 2026 12:28:29 +0000 EUVD Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60701 euvd:EUVD-2026-60701 Tue, 18 Aug 2026 12:26:35 +0000 EUVD External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60550 euvd:EUVD-2026-60550 Tue, 18 Aug 2026 12:26:09 +0000 EUVD An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component https://euvd.enisa.europa.eu/enisa/EUVD-2026-60700 euvd:EUVD-2026-60700 Tue, 18 Aug 2026 12:23:41 +0000 EUVD Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60699 euvd:EUVD-2026-60699 Tue, 18 Aug 2026 12:23:41 +0000 EUVD Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60673 euvd:EUVD-2026-60673 Tue, 18 Aug 2026 12:23:35 +0000 EUVD Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60672 euvd:EUVD-2026-60672 Tue, 18 Aug 2026 12:23:34 +0000 EUVD Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. https://nvd.nist.gov/vuln/detail/CVE-2026-75855 nvd:CVE-2026-75855 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access. https://nvd.nist.gov/vuln/detail/CVE-2026-75854 nvd:CVE-2026-75854 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates. https://nvd.nist.gov/vuln/detail/CVE-2026-75853 nvd:CVE-2026-75853 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1. https://nvd.nist.gov/vuln/detail/CVE-2026-75852 nvd:CVE-2026-75852 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. https://nvd.nist.gov/vuln/detail/CVE-2026-75851 nvd:CVE-2026-75851 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1. https://nvd.nist.gov/vuln/detail/CVE-2026-75846 nvd:CVE-2026-75846 Tue, 18 Aug 2026 12:19:35 +0000 NVD CVE ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability. https://nvd.nist.gov/vuln/detail/CVE-2026-75844 nvd:CVE-2026-75844 Tue, 18 Aug 2026 12:19:34 +0000 NVD CVE ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations. https://nvd.nist.gov/vuln/detail/CVE-2026-75843 nvd:CVE-2026-75843 Tue, 18 Aug 2026 12:19:34 +0000 NVD CVE ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. https://nvd.nist.gov/vuln/detail/CVE-2026-75842 nvd:CVE-2026-75842 Tue, 18 Aug 2026 12:19:34 +0000 NVD CVE ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses. https://nvd.nist.gov/vuln/detail/CVE-2026-75840 nvd:CVE-2026-75840 Tue, 18 Aug 2026 12:19:34 +0000 NVD CVE ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process. https://nvd.nist.gov/vuln/detail/CVE-2026-75837 nvd:CVE-2026-75837 Tue, 18 Aug 2026 12:19:33 +0000 NVD CVE Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities. https://nvd.nist.gov/vuln/detail/CVE-2026-75836 nvd:CVE-2026-75836 Tue, 18 Aug 2026 12:19:33 +0000 NVD CVE The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics. https://nvd.nist.gov/vuln/detail/CVE-2026-75831 nvd:CVE-2026-75831 Tue, 18 Aug 2026 12:19:33 +0000 NVD CVE Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions. https://nvd.nist.gov/vuln/detail/CVE-2026-75830 nvd:CVE-2026-75830 Tue, 18 Aug 2026 12:19:32 +0000 NVD CVE grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15. https://nvd.nist.gov/vuln/detail/CVE-2026-75829 nvd:CVE-2026-75829 Tue, 18 Aug 2026 12:19:32 +0000 NVD CVE grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time. https://nvd.nist.gov/vuln/detail/CVE-2026-75828 nvd:CVE-2026-75828 Tue, 18 Aug 2026 12:19:32 +0000 NVD CVE Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered. https://nvd.nist.gov/vuln/detail/CVE-2026-75827 nvd:CVE-2026-75827 Tue, 18 Aug 2026 12:19:32 +0000 NVD CVE Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-74906 nvd:CVE-2026-74906 Tue, 18 Aug 2026 12:19:30 +0000 NVD CVE SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints. https://nvd.nist.gov/vuln/detail/CVE-2026-74905 nvd:CVE-2026-74905 Tue, 18 Aug 2026 12:19:30 +0000 NVD CVE SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure. https://nvd.nist.gov/vuln/detail/CVE-2026-74904 nvd:CVE-2026-74904 Tue, 18 Aug 2026 12:19:30 +0000 NVD CVE SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace. https://nvd.nist.gov/vuln/detail/CVE-2026-74902 nvd:CVE-2026-74902 Tue, 18 Aug 2026 12:19:30 +0000 NVD CVE SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor. https://nvd.nist.gov/vuln/detail/CVE-2026-15585 nvd:CVE-2026-15585 Tue, 18 Aug 2026 12:17:23 +0000 NVD CVE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60617 euvd:EUVD-2026-60617 Tue, 18 Aug 2026 11:23:26 +0000 EUVD Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60616 euvd:EUVD-2026-60616 Tue, 18 Aug 2026 11:19:57 +0000 EUVD ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60615 euvd:EUVD-2026-60615 Tue, 18 Aug 2026 11:19:57 +0000 EUVD ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60614 euvd:EUVD-2026-60614 Tue, 18 Aug 2026 11:19:56 +0000 EUVD ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60613 euvd:EUVD-2026-60613 Tue, 18 Aug 2026 11:19:55 +0000 EUVD ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60612 euvd:EUVD-2026-60612 Tue, 18 Aug 2026 11:19:55 +0000 EUVD ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60610 euvd:EUVD-2026-60610 Tue, 18 Aug 2026 11:19:53 +0000 EUVD ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60608 euvd:EUVD-2026-60608 Tue, 18 Aug 2026 11:19:51 +0000 EUVD ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60607 euvd:EUVD-2026-60607 Tue, 18 Aug 2026 11:19:51 +0000 EUVD ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60606 euvd:EUVD-2026-60606 Tue, 18 Aug 2026 11:19:50 +0000 EUVD ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60604 euvd:EUVD-2026-60604 Tue, 18 Aug 2026 11:19:49 +0000 EUVD ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60601 euvd:EUVD-2026-60601 Tue, 18 Aug 2026 11:19:47 +0000 EUVD Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60600 euvd:EUVD-2026-60600 Tue, 18 Aug 2026 11:19:46 +0000 EUVD The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60599 euvd:EUVD-2026-60599 Tue, 18 Aug 2026 11:19:45 +0000 EUVD Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60597 euvd:EUVD-2026-60597 Tue, 18 Aug 2026 11:19:44 +0000 EUVD The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60596 euvd:EUVD-2026-60596 Tue, 18 Aug 2026 11:19:43 +0000 EUVD The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user's scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope's file listing, despite the key not being granted api.users.write. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60594 euvd:EUVD-2026-60594 Tue, 18 Aug 2026 11:19:42 +0000 EUVD grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60593 euvd:EUVD-2026-60593 Tue, 18 Aug 2026 11:19:41 +0000 EUVD grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60592 euvd:EUVD-2026-60592 Tue, 18 Aug 2026 11:19:41 +0000 EUVD Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.