VulnSocial

CVE-2026-56708Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-367

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-25: 108-25
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • MalwareObserver@MalwareObserver
    Disclosure

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-56708](https://github.com/getgrav/grav/security/advisories/GHSA-hq2v-cgw4-fw2w) Grav AP... https://github.com/getgrav/grav/security/advisories/GHSA-hq2v-cgw4-fw2w #Vulnerability #CVE #ZeroDay

    Post summary

    The tweet announces CVE‑2026‑56708 and indicates it is a ZeroDay vulnerability, directing readers to a GitHub advisory, but it provides no technical details, PoC, exploit code, or patch information.

    0000047
    27 followersView on X

Explore more

Back to dashboard