https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T05:51:33.399621+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335900 EUVD-2026-335900 2026-10-10T05:51:33.451250+00:00 EUVD-2026-335900 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61454 fkie_cve-2026-61454 2026-10-10T05:51:33.451288+00:00

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.

 https://cve.radiocsirt.org/vuln/ghsa-q4j8-3jf6-pjvp GHSA-q4j8-3jf6-pjvp 2026-10-10T05:51:33.451324+00:00

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.