Login Request a demo
GR
Product
grist-core
by gristlabs · last CVE Jul 10, 2026
9
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 1High 2Medium 6Low 0
Severity
All severities9Critical1High2Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add grist-core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-24002
9.6
1%
Jan 22
pyodide sandbox option is insecure
Affected: < 1.7.9
CVE-2026-55665
8.5
1%
Jul 10
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
Affected: < 1.7.15
CVE-2026-55659
7.7
0%
Jul 10
Grist: XSS through unsafe value interpolation in server-rendered pages
Affected: < 1.7.15
CVE-2025-64753
6.5
0%
Nov 13
grist-core has insufficient access control in endpoints for comparisons between documents and versions
Affected: < 1.7.7
CVE-2025-64752
6.5
0%
Nov 13
grist-core has path to server-side requests via websocket
Affected: < 1.7.7
CVE-2024-56359
6.1
0%
Dec 20
Cross-site Scripting vulnerability through HyperLink cells in grist-core
Affected: < 1.3.2
CVE-2024-56358
6.1
0%
Dec 20
Cross-site Scripting vulnerability through svg attachment previews in grist-core
Affected: < 1.3.2
CVE-2024-56357
6.1
0%
Dec 20
Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
Affected: < 1.3.1
CVE-2026-55664
4.3
0%
Jul 10
Grist: Insufficient access control in the /forms endpoint exposes table metadata
Affected: < 1.7.15
Showing 9