EUVD-2026-45121

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

EUVD-2026-45119

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...

CVE-2026-57076

creationtimestamp| type| source ---|---|--- 2026-07-17 00:03:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsh6birny2m 2026-07-17 01:08:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsktsqhdz27...

CVE-2026-14253

creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...

CVE-2026-45368

creationtimestamp| type| source ---|---|--- 2026-07-16 23:33:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfii3i6n2h...

CVE-2026-44177

creationtimestamp| type| source ---|---|--- 2026-07-16 22:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsdbhwdsg2n...

CVE-2026-52869

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...

GHSA-JPW9-PFVF-9F58

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...

CVE-2026-63086

creationtimestamp| type| source ---|---|--- 2026-07-16 19:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwhp7yyy22...

CVE-2026-34212

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:31+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-17 00:00:47+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-18 04:00:03+00:00| published-proof-of-concept|...

CVE-2026-34213

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:30+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-17 00:00:47+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-18 04:00:03+00:00| published-proof-of-concept|...

CVE-2026-9090

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:21+00:00| seen| Telegram/KAYuHSInUTyY5sdHqTfJ-t-JAYNMtvmTlSN5y1liuC5CE 2026-07-17 00:00:38+00:00| seen| Telegram/KAYuHSInUTyY5sdHqTfJ-t-JAYNMtvmTlSN5y1liuC5CE 2026-07-18 00:00:22+00:00| published-proof-of-concept|...

CVE-2026-4298

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:19+00:00| seen| Telegram/Rc0b9T17FJVJElH6QZhazeHK5sevkoWVsl-YVplQMonaEk 2026-07-17 00:00:36+00:00| seen| Telegram/Rc0b9T17FJVJElH6QZhazeHK5sevkoWVsl-YVplQMonaEk 2026-07-18 00:00:24+00:00| published-proof-of-concept|...

CVE-2026-52614

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:07+00:00| seen| Telegram/eJTmWIryt99ubO9QtbnCAouqtws-13ZSYrG03ttlIfqzwDU 2026-07-16 19:00:08+00:00| seen| Telegram/5paqE9BZADOOkHSdC7twZCndT-XIbW43N6J0-aUcERlCO6E 2026-07-17 00:00:09+00:00| published-proof-of-concept|...

CVE-2026-15706

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:07+00:00| seen| Telegram/iYHsotoqlE8Z-AEKaQiVsXXSjTyl0MfV01akvHQ1zfYFYEI 2026-07-17 00:00:10+00:00| published-proof-of-concept| Telegram/iYHsotoqlE8Z-AEKaQiVsXXSjTyl0MfV01akvHQ1zfYFYEI...

CVE-2026-63087

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-59863

creationtimestamp| type| source ---|---|--- 2026-07-16 16:45:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqroonmn3q2m...

CVE-2026-63087

creationtimestamp| type| source ---|---|--- 2026-07-16 16:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqromxze3h2c 2026-07-16 19:09:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwqns4ep22 2026-07-17 14:00:05+00:00| published-proof-of-concept|...

CVE-2026-15352

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:39+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-03 2026-07-16 23:23:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsewl6cyb2e...