[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-72702":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-24T22:49:06.576Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":424,"aliases":425,"duplicate_of":9,"upstream":426,"downstream":427,"duplicates":428,"related":429,"reserved_at":9,"published_at":430,"modified_at":430,"state":431,"summary":432,"references_raw":439,"kevs":451,"epss":9,"epss_history":452,"metrics":453,"affected":467},"CVE-2026-72702","Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-346","Origin Validation Error","The product does not properly verify that the source of data or communication is valid.","weakness","Draft","Class",[19,23,76,88,92,263,267,271,275,279,283,287,291,412,416,420],{"id":20,"name":21,"techniques":22},"CAPEC-111","JSON Hijacking (aka JavaScript Hijacking)",[],{"id":24,"name":25,"techniques":26},"CAPEC-141","Cache Poisoning",[27],{"id":28,"name":29,"tactics":30,"countermeasures":37},"T1557.002","ARP Cache Poisoning",[31,34],{"id":32,"name":33},"TA0031","Credential Access",{"id":35,"name":36},"TA0100","Collection",[38,43,47,51,55,59,63,67,72],{"id":39,"name":40,"tactic":41},"D3-NTCD","Network Traffic Community Deviation",{"name":42},"Detect",{"id":44,"name":45,"tactic":46},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":42},{"id":48,"name":49,"tactic":50},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":42},{"id":52,"name":53,"tactic":54},"D3-CSPP","Client-server Payload Profiling",{"name":42},{"id":56,"name":57,"tactic":58},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":42},{"id":60,"name":61,"tactic":62},"D3-NTSA","Network Traffic Signature Analysis",{"name":42},{"id":64,"name":65,"tactic":66},"D3-APCA","Application Protocol Command Analysis",{"name":42},{"id":68,"name":69,"tactic":70},"D3-NTF","Network Traffic Filtering",{"name":71},"Isolate",{"id":73,"name":74,"tactic":75},"D3-RTSD","Remote Terminal Session Detection",{"name":42},{"id":77,"name":78,"techniques":79},"CAPEC-142","DNS Cache Poisoning",[80],{"id":81,"name":82,"tactics":83,"countermeasures":87},"T1584.002","DNS Server",[84],{"id":85,"name":86},"TA0042","Resource Development",[],{"id":89,"name":90,"techniques":91},"CAPEC-160","Exploit Script-Based APIs",[],{"id":93,"name":94,"techniques":95},"CAPEC-21","Exploitation of Trusted Identifiers",[96,211,239],{"id":97,"name":98,"tactics":99,"countermeasures":109},"T1134","Access Token Manipulation",[100,103,106],{"id":101,"name":102},"TA0030","Defense Evasion",{"id":104,"name":105},"TA0005","Stealth",{"id":107,"name":108},"TA0111","Privilege Escalation",[110,114,118,122,126,131,135,139,144,149,154,158,162,166,170,174,179,183,187,191,195,199,203,207],{"id":111,"name":112,"tactic":113},"D3-CTS","Credential Transmission Scoping",{"name":71},{"id":115,"name":116,"tactic":117},"D3-CCSA","Credential Compromise Scope Analysis",{"name":42},{"id":119,"name":120,"tactic":121},"D3-OPM","Operational Process Monitoring",{"name":42},{"id":123,"name":124,"tactic":125},"D3-PSA","Process Spawn Analysis",{"name":42},{"id":127,"name":128,"tactic":129},"D3-ST","Session Termination",{"name":130},"Evict",{"id":132,"name":133,"tactic":134},"D3-CR","Credential Revocation",{"name":130},{"id":136,"name":137,"tactic":138},"D3-ANCI","Authentication Cache Invalidation",{"name":130},{"id":140,"name":141,"tactic":142},"D3-CI","Configuration Inventory",{"name":143},"Model",{"id":145,"name":146,"tactic":147},"D3-DUC","Decoy User Credential",{"name":148},"Deceive",{"id":150,"name":151,"tactic":152},"D3-CH","Credential Hardening",{"name":153},"Harden",{"id":155,"name":156,"tactic":157},"D3-HBPI","Hardware-based Process Isolation",{"name":71},{"id":159,"name":160,"tactic":161},"D3-MFA","Multi-factor Authentication",{"name":153},{"id":163,"name":164,"tactic":165},"D3-CRO","Credential Rotation",{"name":153},{"id":167,"name":168,"tactic":169},"D3-TB","Token Binding",{"name":153},{"id":171,"name":172,"tactic":173},"D3-TBA","Token-based Authentication",{"name":153},{"id":175,"name":176,"tactic":177},"D3-RC","Restore Configuration",{"name":178},"Restore",{"id":180,"name":181,"tactic":182},"D3-RIC","Reissue Credential",{"name":178},{"id":184,"name":185,"tactic":186},"D3-NTPM","Network Traffic Policy Mapping",{"name":143},{"id":188,"name":189,"tactic":190},"D3-AM","Access Modeling",{"name":143},{"id":192,"name":193,"tactic":194},"D3-SCF","System Call Filtering",{"name":71},{"id":196,"name":197,"tactic":198},"D3-AEM","Application Exception Monitoring",{"name":42},{"id":200,"name":201,"tactic":202},"D3-SCA","System Call Analysis",{"name":42},{"id":204,"name":205,"tactic":206},"D3-EAL","Executable Allowlisting",{"name":71},{"id":208,"name":209,"tactic":210},"D3-EDL","Executable Denylisting",{"name":71},{"id":212,"name":213,"tactics":214,"countermeasures":216},"T1528","Steal Application Access Token",[215],{"id":32,"name":33},[217,219,221,223,225,227,229,231,233,235,237],{"id":163,"name":164,"tactic":218},{"name":153},{"id":150,"name":151,"tactic":220},{"name":153},{"id":115,"name":116,"tactic":222},{"name":42},{"id":167,"name":168,"tactic":224},{"name":153},{"id":145,"name":146,"tactic":226},{"name":148},{"id":171,"name":172,"tactic":228},{"name":153},{"id":159,"name":160,"tactic":230},{"name":153},{"id":132,"name":133,"tactic":232},{"name":130},{"id":180,"name":181,"tactic":234},{"name":178},{"id":111,"name":112,"tactic":236},{"name":71},{"id":136,"name":137,"tactic":238},{"name":130},{"id":240,"name":241,"tactics":242,"countermeasures":244},"T1539","Steal Web Session Cookie",[243],{"id":32,"name":33},[245,247,249,251,253,255,257,259,261],{"id":115,"name":116,"tactic":246},{"name":42},{"id":180,"name":181,"tactic":248},{"name":178},{"id":163,"name":164,"tactic":250},{"name":153},{"id":136,"name":137,"tactic":252},{"name":130},{"id":132,"name":133,"tactic":254},{"name":130},{"id":145,"name":146,"tactic":256},{"name":148},{"id":111,"name":112,"tactic":258},{"name":71},{"id":150,"name":151,"tactic":260},{"name":153},{"id":159,"name":160,"tactic":262},{"name":153},{"id":264,"name":265,"techniques":266},"CAPEC-384","Application API Message Manipulation via Man-in-the-Middle",[],{"id":268,"name":269,"techniques":270},"CAPEC-385","Transaction or Event Tampering via Application API Manipulation",[],{"id":272,"name":273,"techniques":274},"CAPEC-386","Application API Navigation Remapping",[],{"id":276,"name":277,"techniques":278},"CAPEC-387","Navigation Remapping To Propagate Malicious Content",[],{"id":280,"name":281,"techniques":282},"CAPEC-388","Application API Button Hijacking",[],{"id":284,"name":285,"techniques":286},"CAPEC-510","SaaS User Request Forgery",[],{"id":288,"name":289,"techniques":290},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":292,"name":293,"techniques":294},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[295,325],{"id":296,"name":297,"tactics":298,"countermeasures":302},"T1134.001","Token Impersonation/Theft",[299,300,301],{"id":101,"name":102},{"id":104,"name":105},{"id":107,"name":108},[303,305,307,309,311,313,315,317,319,321,323],{"id":159,"name":160,"tactic":304},{"name":153},{"id":145,"name":146,"tactic":306},{"name":148},{"id":180,"name":181,"tactic":308},{"name":178},{"id":111,"name":112,"tactic":310},{"name":71},{"id":167,"name":168,"tactic":312},{"name":153},{"id":132,"name":133,"tactic":314},{"name":130},{"id":136,"name":137,"tactic":316},{"name":130},{"id":150,"name":151,"tactic":318},{"name":153},{"id":171,"name":172,"tactic":320},{"name":153},{"id":163,"name":164,"tactic":322},{"name":153},{"id":115,"name":116,"tactic":324},{"name":42},{"id":326,"name":327,"tactics":328,"countermeasures":333},"T1550.004","Web Session Cookie",[329,330],{"id":101,"name":102},{"id":331,"name":332},"TA0109","Lateral Movement",[334,336,340,342,344,348,350,352,354,356,358,360,364,368,370,374,378,380,384,386,390,392,394,398,400,402,404,406,408,410],{"id":155,"name":156,"tactic":335},{"name":71},{"id":337,"name":338,"tactic":339},"D3-PLA","Process Lineage Analysis",{"name":42},{"id":132,"name":133,"tactic":341},{"name":130},{"id":52,"name":53,"tactic":343},{"name":42},{"id":345,"name":346,"tactic":347},"D3-HR","Host Reboot",{"name":130},{"id":60,"name":61,"tactic":349},{"name":42},{"id":44,"name":45,"tactic":351},{"name":42},{"id":64,"name":65,"tactic":353},{"name":42},{"id":115,"name":116,"tactic":355},{"name":42},{"id":39,"name":40,"tactic":357},{"name":42},{"id":163,"name":164,"tactic":359},{"name":153},{"id":361,"name":362,"tactic":363},"D3-PS","Process Suspension",{"name":130},{"id":365,"name":366,"tactic":367},"D3-KBPI","Kernel-based Process Isolation",{"name":71},{"id":192,"name":193,"tactic":369},{"name":71},{"id":371,"name":372,"tactic":373},"D3-PT","Process Termination",{"name":130},{"id":375,"name":376,"tactic":377},"D3-HS","Host Shutdown",{"name":130},{"id":56,"name":57,"tactic":379},{"name":42},{"id":381,"name":382,"tactic":383},"D3-PSMD","Process Self-Modification Detection",{"name":42},{"id":145,"name":146,"tactic":385},{"name":148},{"id":387,"name":388,"tactic":389},"D3-WSAM","Web Session Access Mediation",{"name":71},{"id":48,"name":49,"tactic":391},{"name":42},{"id":150,"name":151,"tactic":393},{"name":153},{"id":395,"name":396,"tactic":397},"D3-ABPI","Application-based Process Isolation",{"name":71},{"id":180,"name":181,"tactic":399},{"name":178},{"id":73,"name":74,"tactic":401},{"name":42},{"id":111,"name":112,"tactic":403},{"name":71},{"id":136,"name":137,"tactic":405},{"name":130},{"id":159,"name":160,"tactic":407},{"name":153},{"id":123,"name":124,"tactic":409},{"name":42},{"id":68,"name":69,"tactic":411},{"name":71},{"id":413,"name":414,"techniques":415},"CAPEC-75","Manipulating Writeable Configuration Files",[],{"id":417,"name":418,"techniques":419},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":421,"name":422,"techniques":423},"CAPEC-89","Pharming",[],[],[],[],[],[],[],"2026-08-25T01:30:25.032Z","Received",{"cisa_kev":433,"cisa_ransomware":433,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":434,"severity_score":435,"severity_version":436,"severity_source":437,"severity_vector":438,"severity_status":431},false,"critical",9.3,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",[440,446],{"url":441,"sources":442,"tags":444},"https://github.com/getgrav/grav/security/advisories/GHSA-9ccq-2jfg-qw33",[437,443],"nvd",[445],"Vendor Advisory",{"url":447,"sources":448,"tags":449},"https://www.vulncheck.com/advisories/grav-cms-before-origin-validation-bypass-via-referer",[437,443],[450],"Third Party Advisory",[],[],[454,463],{"source":437,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":455,"cvss_v4_0":461},{"baseScore":456,"baseSeverity":457,"vectorString":458,"impactScore":459,"exploitabilityScore":460},5.4,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",4.2,7.2,{"baseScore":435,"baseSeverity":462,"vectorString":438,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":443,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":464,"cvss_v4_0":465},{"baseScore":456,"baseSeverity":457,"vectorString":458,"impactScore":459,"exploitabilityScore":460},{"baseScore":435,"baseSeverity":462,"vectorString":466,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[468],{"ecosystem":9,"name":469,"vendor":470,"product":469,"cpe_part":471,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":472},"grav","getgrav","a",[473],{"version":474,"is_range":475,"range_type":437,"version_start":9,"version_start_type":9,"version_end":476,"version_end_type":477,"fixed_in":9},"\u003C 2.0.16",true,"2.0.16","excluding"]