6727 matches found
CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...
PT-2026-78331
Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...
CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...
EUVD-2026-61130
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
EUVD-2026-61129
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
EUVD-2026-60601
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...
CVE-2026-15602
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-59851
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
PT-2026-73143
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...
CVE-2026-73046
Technical details for CVE-2026-73046 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.
CVE-2026-73046
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...
CVE-2026-18216
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...
CVE-2026-68752
A Project Resource Manager may gain broader administrative privileges under specific conditions...
CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup
Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...
EUVD-2026-57231
Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...
Exploit for CVE-2026-72898
🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...
GHSA-VWF4-M7J8-WCJF
creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:05+00:00| seen| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-13 00:00:43+00:00| published-proof-of-concept| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-16 20:29:14+00:00| seen|...
CVE-2026-72559
HortusFox 5.9 contains a stored cross-site scripting vulnerability that lets authenticated workspace members inject persistent JavaScript into plant notes. Parsedown rendering without safe mode renders notes unescaped for every user viewing the affected plant, enabling potential session cookie th...