Security advisories

medium2026-09-18

CVE-2026-77607-Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

View chart →

semanticmediawiki/semanticmediawiki · GHSA-7xv3-gf2g-498h

medium2026-09-18

CVE-2026-77608-Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

View chart →

semanticmediawiki/semanticmediawiki · GHSA-59xw-qv23-j3rc

medium2026-09-18

CVE-2026-77606-Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

View chart →

semanticmediawiki/semanticmediawiki · GHSA-3jp5-3h47-28qf

high2026-09-18

CVE-2025-61682-Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

View chart →

semanticmediawiki/semanticmediawiki · GHSA-hg8h-557g-q8pp

critical2026-09-18

CVE-2025-53837-org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

View chart →

xwiki/xwiki-rendering · GHSA-26vp-8gxg-v4pg

high2026-09-18

CVE-2026-77615-Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

View chart →

opencast/opencast · GHSA-m6c8-jcw2-5r25

medium2026-09-18

CVE-2026-77281-Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

View chart →

caddyserver/caddy · GHSA-j8px-rmrx-76h9

high2026-09-17

CVE-2026-72819-Grav CMS vulnerable to remote code execution via .zip file upload

View chart →

getgrav/grav · GHSA-r94f-hx44-8jqf

high2026-09-17

CVE-2026-75837-Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

View chart →

getgrav/grav · GHSA-xhfv-7758-r9hx

medium2026-09-17

CVE-2026-75834-Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

View chart →

getgrav/grav · GHSA-q2j8-x8hf-63ch

critical2026-09-17

CVE-2026-75827-Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

View chart →

getgrav/grav · GHSA-f8wv-xp27-6gq7

critical2026-09-17

CVE-2026-75828-Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

View chart →

getgrav/grav · GHSA-vfmf-q6x9-cw96

high2026-09-17

CVE-2026-74907-Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

View chart →

getgrav/grav · GHSA-4v9q-p283-qc2m

high2026-09-17

CVE-2026-72695-Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

View chart →

getgrav/grav · GHSA-jq29-c7v8-rg55

high2026-09-17

CVE-2026-86003-CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

View chart →

coredns/coredns · GHSA-9gm5-9rfh-m6vx

medium2026-09-17

CVE-2026-86000-Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

View chart →

facelessuser/soupsieve · GHSA-gjv8-xp57-g29c

medium2026-09-17

CVE-2026-85999-Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

View chart →

facelessuser/soupsieve · GHSA-j934-xhv5-fg8f

medium2026-09-17

CVE-2026-88976-@platejs/core HTML deserialization can trigger browser behavior during parsing

View chart →

udecode/plate · GHSA-qrfj-mgw8-j9c6

high2026-09-17

CVE-2026-84997-react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

View chart →

reactphp/http · GHSA-x424-64qh-5j54

high2026-09-17

CVE-2026-82399-CoreDNS: Unauthenticated memory exhaustion in custom transports

View chart →

coredns/coredns · GHSA-mrg3-qvqr-jw29