CVE-2026-65947

The Joomla Extension - balbooa.com Gridbox software is affected by multiple Cross-Site Request Forgery (CSRF) vectors located within its admin interface. This vulnerability affects versions prior to 2.20.2 . Specific technical details regarding the root cause or exploit methods are not provided i...

CVE-2026-65947

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65947 Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65947 Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

PT-2026-65804

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65947: Cross-Site Request Forgery (CSRF)

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-12989

CVE-2026-12989 describes a lack of authentication in Ghost Robotics' Vision 60 mobile app (APK v5.5.0). An unauthenticated attacker on the device’s internal Wi‑Fi can access the web administration interface and HTTP API, bypassing authorization to view real‑time camera feeds, control robot moveme...

pingap v0.1.3.6

pingap Before the pingap version is stable, no pull requests will be accepted. If you have any questions, please create a new issue first. Overview Pingap is a high-performance reverse proxy powered by the Cloudflare Pingora . It simplifies operational management by enabling dynamic, zero-downtim...

GO-2026-5961 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel...

CVE-2026-48009

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...

CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

CVE-2026-16106

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-62235

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

PT-2026-60801

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite...

MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php

MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature admconfigset.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with a...

CVE-2026-57996

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USERADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and...