https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:18:25.614561+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-372002 EUVD-2026-372002 2026-10-06T22:18:25.666369+00:00 EUVD-2026-372002 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86194 fkie_cve-2026-86194 2026-10-06T22:18:25.666408+00:00

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.

 https://cve.radiocsirt.org/vuln/ghsa-99h4-pmfq-pv63 GHSA-99h4-pmfq-pv63 2026-10-06T22:18:25.666444+00:00

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.