category: Research

2026-09-05 Grav stored XSS via assets sandbox allowlist (editor→super-admin) CVE-2026-86197
2026-09-04 phpMyFAQ: session-only auth downgrade, password change without verification, and TOTP secret in data export
2026-08-28 File Browser: stale shares, share cleanup, named-pipe DoS, and TUS race