https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T14:20:06.090649+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-56709 CVE-2026-56709 — Grav before 3.9.2 Host Header Injection via sendInvitationEmail 2026-10-05T14:20:06.092863+00:00

Affected: getgrav grav

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.