gristlabs grist-core

• CVE-2026-55664 Medium 4.3 Grist: Insufficient access control in the /forms endpoint exposes table metadata 0.3%
• CVE-2026-55665 High 8.5 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation 0.5%
• CVE-2026-55659 High 7.7 Grist: XSS through unsafe value interpolation in server-rendered pages 0.4%
• CVE-2026-24002 Critical 9.1 pyodide sandbox option is insecure 0.5%
• CVE-2025-64753 Medium 5.3 grist-core has insufficient access control in endpoints for comparisons between documents and versions 0.2%
• CVE-2025-64752 Medium 6.8 grist-core has path to server-side requests via websocket 0.2%
• CVE-2024-56359 High 8.1 Cross-site Scripting vulnerability through HyperLink cells in grist-core 0.3%
• CVE-2024-56358 High 8.1 Cross-site Scripting vulnerability through svg attachment previews in grist-core 0.3%
• CVE-2024-56357 High 8.1 Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core 0.3%