GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
13 advisories
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Low
CVE-2026-72702
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
High
CVE-2026-72698
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
High
CVE-2026-76846
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
High
CVE-2026-76839
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
High
CVE-2026-72697
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
High
CVE-2026-74907
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
Low
CVE-2026-74802
was published
for
github.com/siyuan-note/siyuan/kernel
(Go)
Oct 2, 2026
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
High
CVE-2026-74904
was published
for
github.com/siyuan-note/siyuan/kernel
(Go)
Oct 2, 2026
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Moderate
GHSA-3cm4-ccvw-6xr6
was published
for
github.com/siyuan-note/siyuan/kernel
(Go)
Oct 5, 2026
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
Moderate
CVE-2026-62204
was published
for
github.com/siyuan-note/siyuan/kernel
(Go)
Oct 23, 2026
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Low
CVE-2026-72701
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
Moderate
CVE-2026-60083
was published
for
github.com/siyuan-note/siyuan/kernel
(Go)
Oct 27, 2026
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Moderate
CVE-2026-114618
was published
for
authlib
(pip)
Oct 27, 2026
ProTip!
Advisories are also available from the
GraphQL API