EUVD-2026-62539

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...

CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in its two-factor authentication step. The root cause is that the TOTP failure counter is session-scoped and resets on each successful password re-authentication. An attacker who already possesses a valid password can bypass the five-atte...

CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...

CVE-2026-76207

phpMyFAQ before 4.1.7 issues remember-me cookies before 2FA verification, allowing attackers with valid credentials to skip the 2FA challenge and replay the cookie for full authenticated access. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade to 4.1.7; advisory at https://github.com/...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

CVE-2026-67364

Balbooa Forms for Joomla (versions

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

EUVD-2026-62396

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

SummaryGlances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead o...

Security update for open-iscsi

This update for open-iscsi fixes the following issues: CVE-2026-44943: remote file-write as root via discovery bsc1268353. CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

SUSE-SU-2026:3647-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: - Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

PT-2026-78777

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the schedule search capability can configure PD...

Oracle Linux 9 : curl (ELSA-2026-55439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory. - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix SSH host key...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...

PT-2026-78352

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without...