CVE-2026-129091

Published 15 November 2026 · tracked since 15 November 2026

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes GrandPrix Core grandprix-core allows PHP Local File Inclusion.This issue affects GrandPrix Core: from n/a through 1.0.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-125822 HIGH 7.1
• CVE-2026-125795 CRITICAL 9.8
• CVE-2026-125771 HIGH 7.2
• CVE-2026-129482 MEDIUM 4.8
• CVE-2026-125449 HIGH 8.8
• CVE-2026-122662 CRITICAL 9.8
• CVE-2026-82663 HIGH 7.5
• CVE-2026-82568 HIGH 7.5
• CVE-2026-129349
• CVE-2026-129444 CRITICAL 10

→ Open the live CVE board · all tools