Security advisories

high2026-05-05

CVE-2026-42327-rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

rust-openssl/rust-openssl · GHSA-xp3w-r5p5-63rr

high2026-05-05

CVE-2026-32688-Plug.Cowboy vulnerable to unauthenticated remote DoS via HTTP/2 `:scheme` atom-table exhaustion

elixir-plug/plug_cowboy · GHSA-q8x4-x7mp-5vg2

high2026-05-05

CVE-2026-42611-Grav is Vulnerable to Stored XSS via Tag Injection

getgrav/grav · GHSA-w8cg-7jcj-4vv2

medium2026-05-05

CVE-2026-56701-Grav is Vulnerable to XXE via SVG Upload

getgrav/grav · GHSA-3446-6mgw-f79p

high2026-05-05

CVE-2026-42608-Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

getgrav/grav · GHSA-hmcx-ch82-3fv2

high2026-05-05

CVE-2026-42997-OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

openstack/ironic-python-agent · GHSA-54w4-233h-x86g

high2026-05-05

CVE-2026-42609-Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

getgrav/grav · GHSA-rr73-568v-28f8

low2026-05-05

CVE-2026-7317-Grav has Insecure Deserialization in File Cache

getgrav/grav · GHSA-gwfr-jfjf-92vv

critical2026-05-05

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

getgrav/grav · GHSA-vj3m-2g9h-vm4p

high2026-05-05

CVE-2026-42612-Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

getgrav/grav · GHSA-9695-8fr9-hw5q

medium2026-05-05

CVE-2026-42610-Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

getgrav/grav · GHSA-3f29-pqwf-v4j4

critical2026-05-05

CVE-2026-42613-Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

getgrav/grav · GHSA-pxm6-mhxr-q4mj

medium2026-05-05

CVE-2026-42842-Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

getgrav/grav · GHSA-c2q3-p4jr-c55f

medium2026-05-05

CVE-2026-42841-Grav CMS vulnerable to stored XSS via Markdown media attribute() action

getgrav/grav · GHSA-r7fx-8g49-7hhr

critical2026-05-05

CVE-2026-42607-Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

getgrav/grav · GHSA-w48r-jppp-rcfw

high2026-05-05

CVE-2026-42843-Grav API Privilege Escalation to Super Admin

getgrav/grav · GHSA-r945-h4vm-h736

high2026-05-05

CVE-2026-42315-PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

pyload/pyload · GHSA-838g-gr43-qqg9

high2026-05-05

CVE-2026-44167-phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

phpseclib/phpseclib · GHSA-3qpq-r242-jqj7

medium2026-05-05

CVE-2026-44166-PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

pocketbase/pocketbase · GHSA-pq7p-mc74-g65w

high2026-05-05

CVE-2026-43891-changedetection.io has an Arbitrary Local File Read via a crafted backup restore

dgtlmoon/changedetection.io · GHSA-8757-69j2-hx56