{"vulnerability": "CVE-2026-5919", "sightings": [{"uuid": "4d9a2b07-c9cf-4e3e-b63f-30c923be2b5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260409", "content": "", "creation_timestamp": "2026-04-08T18:00:00.000000Z"}, {"uuid": "e6bffbc1-0460-419f-bf35-5f6a7ac96280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "78e2fb22-f220-4dd0-a9b5-408555f2a81b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "941b07c9-d711-4425-bc46-ac390eb5dbfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59196", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhgmpw5b27", "content": "CVE-2026-59196 - pnpm: hoisted install imports lockfile alias outside node_modules\nCVE ID : CVE-2026-59196\n \n Published : July 6, 2026, 3:18 p.m. | 29\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined ...", "creation_timestamp": "2026-07-06T15:58:42.371712Z"}, {"uuid": "591d88d5-6498-42dd-a09b-61339d5efa29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59194", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyi3sovst2q", "content": "CVE-2026-59194 - pnpm: patch-remove could delete project-selected files outside the patches directory\nCVE ID : CVE-2026-59194\n \n Published : July 6, 2026, 3:16 p.m. | 31\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry ...", "creation_timestamp": "2026-07-06T16:10:33.447729Z"}, {"uuid": "ec8a7115-e778-460f-8e02-e2f6685680af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyiac7bhz2h", "content": "CVE-2026-59195 - pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config\nCVE ID : CVE-2026-59195\n \n Published : July 6, 2026, 3:21 p.m. | 27\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 1...", "creation_timestamp": "2026-07-06T16:13:06.107423Z"}, {"uuid": "9cd59299-36d8-49c5-b0fa-3ac161557a11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mq2akkns5g2g", "content": "CVE-2026-59195 - Path Traversal in pnpm. Malicious lockfile can create symlinks outside expected directory. CVSS 8.2. Update to 10.34.4 or 11.8.0 immediately. #CVE #pnpm #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-59195/", "creation_timestamp": "2026-07-07T09:00:57.706747Z"}, {"uuid": "b034a43e-1478-4a1b-8ba0-8b10e6fa948b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59190", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdascvdwg2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59190 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Grav Admin: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8A0CAD34-416D-43F3-AE94-51B43564662B", "creation_timestamp": "2026-07-10T22:59:15.571452Z"}, {"uuid": "cf492a3a-d358-4988-9dc9-4bd83ea15d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59193", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbicyild2z", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59193 \u0432 Grav: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0432\u0435\u0431-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\n\n\n\nhttps://kripta.biz/posts/B23F11D5-D91E-4846-95BD-96FFBD313EA2", "creation_timestamp": "2026-07-10T23:11:33.989454Z"}, {"uuid": "2807c78e-06e4-4ef4-97f7-0280a8e7cb01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59190", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddb35rt72s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59190 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Grav Admin: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7F03F1C1-65CE-4D24-9E62-5B2687FE1002", "creation_timestamp": "2026-07-10T23:43:18.246494Z"}, {"uuid": "5af54793-029c-44c5-89c5-edcc07ff996a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqztqy7dvw26", "content": "\ud83d\udccc CVE-2026-59195 - pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those nam... https://www.cyberhub.blog/cves/CVE-2026-59195", "creation_timestamp": "2026-07-19T22:37:06.616985Z"}, {"uuid": "c9062d4b-8991-4ac5-a8b1-3ccbe427115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59199", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "content": "", "creation_timestamp": "2026-07-21T00:35:17.054203Z"}, {"uuid": "a93e4b91-54c3-45a2-9228-2e5a1202c80e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59198", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq", "content": "", "creation_timestamp": "2026-07-21T00:35:19.270704Z"}, {"uuid": "4d7d9870-4e6d-428d-bd3e-c6cb96013472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59197", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "content": "", "creation_timestamp": "2026-07-21T00:35:21.497750Z"}, {"uuid": "63016cc9-eb72-4511-9214-60741dcc43b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59199", "type": "seen", "source": "https://gist.github.com/alon710/8369d28698d5eaa2f4badffaca60e4b4", "content": "# CVE-2026-59199: CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59199\n\n## Summary\nA critical signed 32-bit integer overflow vulnerability was identified in Pillow (Python Imaging Library) versions prior to 12.3.0. The vulnerability resides within the native C extension library (libImaging) during coordinate and bounding box calculations in functions like ImagingPaste and ImagingFill2. Exploitation can bypass bounds and clipping safety checks, leading to a controlled heap backward underwrite and application crash.\n\n## TL;DR\nA signed integer overflow in Pillow before 12.3.0 allows unauthenticated remote attackers to bypass memory safety checks and perform a native heap out-of-bounds write via crafted coordinates, leading to a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0039 (Percentile: 31.40%)\n- **Impact**: Denial of Service, Native Heap Corruption\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow prior to version 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or higher\n- Apply strict application-layer validation on bounding box input values\n- Sandbox Python imaging processes inside containerized environments with seccomp policies enabled\n\n**Remediation Steps:**\n1. Identify all environment dependencies referencing Pillow packages prior to version 12.3.0\n2. Update requirements files to specify Pillow>=12.3.0 and redeploy the application\n3. Implement bounding box sanitization functions for any user-facing APIs exposing image coordinate parameters\n\n## References\n\n- [NVD CVE-2026-59199 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-59199)\n- [Pillow Security Advisory GHSA-6r8x-57c9-28j4](https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4)\n- [Fix Pull Request #9703](https://github.com/python-pillow/Pillow/pull/9703)\n- [Fix Commit ceefc348](https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)\n- [Pillow Release 12.3.0 Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59199) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T10:31:21.339083Z"}, {"uuid": "09b1fe6d-25bd-4186-9068-8300edc8fea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59198", "type": "seen", "source": "https://gist.github.com/alon710/48f3deb1ca1eafb4018fbe6276da18c1", "content": "# CVE-2026-59198: CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59198\n\n## Summary\nCVE-2026-59198 is a high-severity heap out-of-bounds read vulnerability in Pillow, the Python imaging library, affecting versions from 5.2.0 up to 12.3.0. The vulnerability occurs in the TGA RLE compression path due to a calculation mismatch between the allocated packed 1-bit row buffer and the byte-level pixel stride assumption in the C-level encoder. This mismatch allows an attacker to leak up to approximately 57 KB of adjacent process heap memory directly into generated TGA image files.\n\n## TL;DR\nA calculation mismatch in Pillow's TGA RLE encoder allows remote attackers to leak up to 57 KB of process heap memory by saving 1-bit images with RLE compression.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: 0.00313\n- **Impact**: Information Disclosure (Heap Leak up to ~57 KB)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (Python Imaging Library)\n- **Pillow**: >= 5.2.0, < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to 12.3.0 or higher\n- Implement strict image mode validation before saving TGA outputs\n- Disable TGA RLE compression for untrusted user inputs\n\n**Remediation Steps:**\n1. Update requirements.txt or dependency configuration to use Pillow>=12.3.0\n2. Execute local test suites to verify that saving 1-bit (mode 1) TGA files with RLE compression raises an OSError exception\n3. Sandbox high-risk image-processing pipelines using isolated worker containers with limited privileges\n\n## References\n\n- [Pillow GitHub Security Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq)\n- [GitHub Pull Request #9709](https://github.com/python-pillow/Pillow/pull/9709)\n- [Official Patch Commit](https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b)\n- [Pillow v12.3.0 Release Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59198)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-59198)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59198) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T11:31:12.909840Z"}, {"uuid": "d8b4b80a-e3cc-4f53-b3a9-b0a965b43e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://gist.github.com/alon710/a3a7380a4e0465c6c32d9063bd8033a6", "content": "# CVE-2026-59197: CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59197\n\n## Summary\nA heap out-of-bounds write vulnerability exists in Pillow prior to version 12.3.0 due to an integer overflow during image expansion calculations. The subsequent patch introduced a division-by-zero regression causing denial of service.\n\n## TL;DR\nInteger overflow in Pillow image expansion leads to heap out-of-bounds write. Initial patch introduces a division-by-zero crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.2\n- **Impact**: Heap Out-of-Bounds Write / Denial of Service\n- **Exploit Status**: PoC Available\n\n## Affected Systems\n\n- Pillow (Python Imaging Library) versions prior to 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade to Pillow 12.3.0 or higher\n- Implement strict input validation on filter sizes at the application boundary\n- Validate margin is non-zero before calling C extension functions\n\n**Remediation Steps:**\n1. Verify the current Pillow version using python -c 'import PIL; print(PIL.__version__)'\n2. Upgrade using pip install --upgrade Pillow>=12.3.0\n3. Deploy updated application code to production\n\n## References\n\n- [GitHub Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr)\n- [Fix Commit](https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1)\n- [Pull Request](https://github.com/python-pillow/Pillow/pull/9695)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59197) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T12:31:41.596835Z"}, {"uuid": "7b1bab5a-915a-49a8-a4ea-3c9a092365ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrafcjbw2i2v", "content": "\ud83d\udccc CVE-2026-59197 - Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very l... https://www.cyberhub.blog/cves/CVE-2026-59197", "creation_timestamp": "2026-07-22T13:07:06.918099Z"}, {"uuid": "6851a8c3-aebb-44a0-8718-b1c5fde74a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrasoxs43p2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59197 \u0432 Pillow: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/1F9D355C-4444-4038-84FC-BAF3A22EF8EB", "creation_timestamp": "2026-07-22T17:06:43.266057Z"}, {"uuid": "51de13f5-f5b2-475b-aaad-8a302a5ac9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrasp47rfm2j", "content": "\u05d7\u05e9\u05d9\u05e4\u05ea \u05e4\u05d2\u05d9\u05e2\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1\u05e4\u05d9\u05d9\u05dc\u05d5: CVE-2026-59197 - \u05db\u05ea\u05d9\u05d1\u05d4 \u05de\u05d7\u05d5\u05e5 \u05dc\u05d2\u05d1\u05d5\u05dc\u05d5\u05ea \u05d4\u05d4\u05e8\u05e3\n\n\n\nhttps://khesef.xyz/posts/4E4B5381-1B26-4051-9A47-90E32480B2B3", "creation_timestamp": "2026-07-22T17:06:47.998686Z"}, {"uuid": "48244ee4-78ea-4523-85c9-5ffb1c70f238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59193", "type": "published-proof-of-concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9", "content": "", "creation_timestamp": "2026-09-17T00:35:12.555538Z"}, {"uuid": "8d851d42-49a9-4c98-9ee0-74c5e695d600", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59193", "type": "seen", "source": "https://gist.github.com/alon710/b4c3012210552826178a239bffbc7d9c", "content": "# CVE-2026-59193: CVE-2026-59193: Remote Denial of Service via Resource Exhaustion in Grav CMS\n\n> **CVSS Score:** 4.9\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59193\n\n## Summary\nA denial-of-service (DoS) and resource exhaustion vulnerability exists in Grav CMS prior to version 2.0.0. The package installer decompressor fails to validate ZIP archive limits before extraction, allowing authenticated administrators to cause disk exhaustion, inode exhaustion, or process termination.\n\n## TL;DR\nAn unvalidated ZIP archive extraction flaw in Grav CMS allows administrators to crash the server or fill up disk space using malicious zip files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409, CWE-674\n- **Attack Vector**: Network (Authenticated)\n- **CVSS v3.1**: 4.9 (Medium)\n- **EPSS Score**: 0.006 (0.60%)\n- **Exploit Status**: Proof of Concept / Technical Tests\n- **CISA KEV**: Not Listed\n- **Impact**: Denial of Service (Disk space exhaustion, Inode exhaustion, Process Crash)\n\n## Affected Systems\n\n- Grav CMS < 2.0.0\n- Grav CMS 2.0.0-beta1 to 2.0.0-rc.10\n- **Grav CMS**: >= 1.0.0, < 2.0.0 (Fixed in: `2.0.0-rc.11 / 2.0.0`)\n- **Grav CMS**: 2.0.0-beta.1 - 2.0.0-rc.10 (Fixed in: `2.0.0-rc.11`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.0 or higher.\n- Configure tight resource thresholds inside system/config/system.yaml.\n- Restrict admin.super permissions to trusted administrative users.\n- Enable the official_gpm_only setting to prevent unofficial archive installation.\n\n**Remediation Steps:**\n1. Identify active Grav CMS deployments and retrieve their current version numbers.\n2. Deploy the 2.0.0 patch or the development release 2.0.0-rc.11 or above.\n3. Edit system/config/system.yaml and configure 'gpm.archive.max_uncompressed_size' to 1073741824, 'gpm.archive.max_files' to 50000, and 'gpm.archive.max_depth' to 48.\n4. Audit the user permission database to remove 'admin.super' privileges from accounts that do not strictly require system-level maintenance capabilities.\n\n## References\n\n- [https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781](https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781)\n- [https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9](https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9)\n- [https://github.com/getgrav/grav/releases/tag/2.0.0](https://github.com/getgrav/grav/releases/tag/2.0.0)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-59193](https://nvd.nist.gov/vuln/detail/CVE-2026-59193)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59193) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T06:32:02.176010Z"}]}