Security advisories

high2025-12-02

CVE-2025-66294-Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

getgrav/grav · GHSA-662m-56v4-3r8f

medium2025-12-02

CVE-2025-66310-Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab

getgrav/grav · GHSA-7g78-5g5g-mvfj

medium2025-12-02

CVE-2025-66309-Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

getgrav/grav · GHSA-65mj-f7p4-wggq

high2025-12-02

CVE-2025-66297-Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

getgrav/grav · GHSA-858q-77wx-hhx6

medium2025-12-02

CVE-2025-66308-Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`

getgrav/grav · GHSA-gqxx-248x-g29f

high2025-12-02

CVE-2025-66295-Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

getgrav/grav · GHSA-h756-wh59-hhjv

low2025-12-02

CVE-2025-10939-Keycloak unable to restrict access to the admin console

keycloak/keycloak · GHSA-vjr8-56p3-fmqq

high2025-12-02

CVE-2025-66412-Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

angular/angular · GHSA-v4hv-rgfq-gp49

high2025-12-02

CVE-2025-66410-Gin-vue-admin has an arbitrary file deletion vulnerability

flipped-aurora/gin-vue-admin · GHSA-jrhg-82w2-vvj7

medium2025-12-02

CVE-2025-66405-Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

portkey-ai/gateway · GHSA-hhh5-2cvx-vmfp

high2025-12-02

CVE-2025-12060-Keras Directory Traversal Vulnerability

keras-team/keras · GHSA-hjqc-jx6g-rwp9

high2025-12-02

CVE-2025-66305-Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

getgrav/grav · GHSA-m8vh-v6r6-w7p6

medium2025-12-02

CVE-2025-66306-Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

getgrav/grav · GHSA-4cwq-j7jv-qmwg

medium2025-12-02

CVE-2025-66415-fastify-reply-from affected by bypass of reply forwarding

fastify/fastify-reply-from · GHSA-2q7r-29rg-6m5h

medium2025-12-02

CVE-2025-66302-Grav vulnerable to Path Traversal allowing server files backup

getgrav/grav · GHSA-j422-qmxp-hv94

medium2025-12-02

CVE-2025-66307-Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

getgrav/grav · GHSA-q3qx-cp62-f6m7

critical2025-12-02

CVE-2025-66401-MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

kapilduraphe/mcp-watch · GHSA-27m7-ffhq-jqrm

medium2025-12-02

CVE-2025-66312-Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`

getgrav/grav · GHSA-rmw5-f87r-w988

medium2025-12-02

CVE-2025-66311-Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

getgrav/grav · GHSA-mpjj-4688-3fxg

medium2025-12-02

CVE-2025-66304-Grav Exposes Password Hashes Leading to privilege escalation

getgrav/grav · GHSA-gq3g-666w-7h85