179939 matches found
CVE-2026-72829
CVE-2026-72829 is an API-key scope-cap bypass in the Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 . The UsersController's create() and update() methods enforce scope caps only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.su...
CVE-2026-72826
getgrav/grav-plugin-api before 1.0.13 is vulnerable to a scope bypass in the createApiKey() function. The function fails to validate that a newly created API key's scopes are a subset of the caller's scopes. Because the self-target path of requireApiKeyPermission() only requires the baseline api....
CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa
The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...
CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa
The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...
EUVD-2026-58636
The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...
cve-analysis-lab
Vulnerability Research & CVE Analysis Lab Analyst: Harsha...
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...
WordPress Customer Email Verification for WooCommerce plugin < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass vulnerability
Unauthenticated Account Takeover via Type-Juggling Authentication Bypass vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Email Verification for WooCommerce versions 3.2.6...
WordPress ShopEngine plugin < 4.9.3 - Customer PII Disclosure via Forced Authentication vulnerability
Customer PII Disclosure via Forced Authentication vulnerability discovered by Farid Narimanov in WordPress Plugin ShopEngine versions 4.9.3...
GO-2026-4751 vulnerabilities
Vulnerabilities for packages: zitadel...
GO-2024-3246 vulnerabilities
Vulnerabilities for packages: vault...
GO-2024-2939 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2023-1723 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2023-2020 vulnerabilities
Vulnerabilities for packages: promxy, prometheus-alertmanager...
GO-2024-2536 vulnerabilities
Vulnerabilities for packages: rancher-webhook...
GO-2026-5213 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5526 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5192 vulnerabilities
Vulnerabilities for packages: openbao...