Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Trilby Media Clear all filters
TI-2026-71134 CVE-2026-109318 · GHSA-cp28-795p-j89g

OS command injection in Grav Git Sync via commit author fields

Priority MEDIUM 42

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0122 Published 2026-10-12 Fixed in 3.4.13 CWE-78
TI-2026-51057 CVE-2026-72831 · GHSA-7cc5-h479-2c5p

Grav through 2.0.11 Authentication Bypass via Flex Objects

Priority HIGH 73

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00855 Published 2026-08-14 Fixed in 1.4.7 CWE-863
TI-2026-41658 CVE-2026-57852 · GHSA-4p4x-7xpg-55gw

Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Priority LOW 29

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00686 Published 2026-07-20 No fix listed CWE-303