Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Packagist getgrav/grav · Upgrade to 2.0.16 or later · <= 2.0.15 · CVE-2026-72697 · GHSA-47ch-6w46-6xm7 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist getgrav/grav · Upgrade to 2.0.16 or later · <= 2.0.15 · CVE-2026-72697 · GHSA-47ch-6w46-6xm7 · amended
Packagist getgrav/grav · Upgrade to 2.0.16 or later · <= 2.0.15 · CVE-2026-76839 · GHSA-3jhr-mxmx-38cx · amended
system, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabledPackagist getgrav/grav · Upgrade to 2.0.16 or later · <= 2.0.15 · CVE-2026-76846 · GHSA-xjw5-q542-3vmr · amended
Packagist getgrav/grav · Upgrade to 2.0.16 or later · < 2.0.16 · CVE-2026-72698 · GHSA-p597-crqc-m349 · amended
Packagist chamilo/chamilo-lms · Upgrade to 2.0.1 or later · <= 2.0.0 · CVE-2026-45140 · GHSA-g4c3-4g96-6g4m · amended
crates.io fulgur · Upgrade to 0.26.0 or later · < 0.26.0 · CVE-2026-68537 · GHSA-4rf6-qx84-q9fv · amended
crates.io fulgur · Upgrade to 0.19.0 or later · < 0.19.0 · CVE-2026-68523 · GHSA-j5cx-ph8g-95v3 · amended
npm @libp2p/peer-store · Upgrade to 12.0.24 or later · >= 8.0.0, < 12.0.24 · CVE-2026-86039 · GHSA-vrf4-mx87-p53w · amended
npm @libp2p/gossipsub · Upgrade to 16.0.5 or later · >= 15.0.0, < 16.0.5 · CVE-2026-86038 · GHSA-c3gv-825q-fvmp · amended
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.12 or 2.16.1 by release line · >= 3.0.0, <= 3.0.11; >= 2.0.0, <= 2.16.0 · CVE-2026-85721 · GHSA-7grg-jcf7-rpmx · amended
NuGet ssh.net · Upgrade to 2026.0.0 or later · < 2026.0.0 · CVE-2026-85756 · GHSA-mggc-4xg6-vcxf · amended
Packagist getgrav/grav · Upgrade to 2.0.11 or later · >= 2.0.10, <= 2.0.10 · CVE-2026-69089 · GHSA-w3f4-8pj2-599w · amended
Packagist getgrav/grav · Upgrade to 2.0.11 or later · >= 2.0.7, < 2.0.11 · CVE-2026-69088 · GHSA-7pgq-cr25-xvc8 · amended
Go oras.land/oras-go/v2 · Upgrade to 2.6.2 or later · <= 2.6.1 · CVE-2026-85731 · GHSA-m37j-52j7-pjw7 · amended
Packagist getgrav/grav · Upgrade to 2.0.9 or later · >= 1.7.0, < 2.0.9 · CVE-2026-65608 · GHSA-c4wf-2xxc-68qm · amended
Go github.com/zalando/skipper · Upgrade to 0.27.37 or later · < 0.27.37 · CVE-2026-86043 · GHSA-5gpm-rgj3-9q76 · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77412 · GHSA-4v58-74mf-rjx3 · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77411 · GHSA-c5pq-fr2g-9jpf · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77410 · GHSA-r9c8-gcjp-xfwh · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77408 · GHSA-j497-x9hr-x34x · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77407 · GHSA-27gv-rfvv-22mv · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77406 · GHSA-rm6m-hrcw-jw33 · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77405 · GHSA-33mj-cw25-m34h · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77404 · GHSA-465g-fh3v-9jw4 · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77403 · GHSA-xwwf-m8fg-p9q2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.