https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T13:16:33.502896+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-340383 EUVD-2026-340383 2026-10-05T13:16:33.585123+00:00 EUVD-2026-340383 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62386 fkie_cve-2026-62386 2026-10-05T13:16:33.585176+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

 https://cve.radiocsirt.org/vuln/ghsa-cx27-6j8x-h4h6 GHSA-cx27-6j8x-h4h6 2026-10-05T13:16:33.585217+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.