CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

EUVD-2026-66395

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...

WordPress MalCare WordPress Security plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin MalCare Security versions 5.16-6.62...

WordPress BlogVault Backup & Staging plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin BlogVault versions 5.16-6.62...

WordPress The WP Remote WordPress plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin The WP Remote WordPress Plugin versions 5.16-6.62...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

EUVD-2026-66377

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197

CVE-2026-19197 is a broken access control vulnerability in Grafana 's dashboard snapshots feature. An organization administrator on a shared Grafana instance can delete snapshots belonging to other organizations and recover a snapshot's secret delete key using only its public share key , enabling...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

PoC_CurveBall

CVE-2020-0601 - CurveBall Destaques PoC para CVE-2020-0601 Solução trivial para chave privada igual a 1 Solução não trivial para 1 chave-privada ordem-da-curva Escrito em C, usa a libcrypto do OpenSSL Requisitos Linux de alguma variedade apt install libssl libssl-dev Ou qualquer gerenciador de...

CVE-2023-34039

CVE-2023-34039 POC per CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight RCE tramite chiave SSH statica Analisi Tecnica Un'analisi delle cause profonde della vulnerabilità è disponibile sul mio blog:...

git-crypt

git-crypt - crittografia trasparente dei file in git git-crypt abilita la crittografia e decrittografia trasparente dei file in un repository git. I file che scegli di proteggere vengono crittografati quando vengono committati e decrittografati quando vengono estratti. git-crypt ti permette di...

CVE-2025-63353

CVE-2025-63353: Vorhersagbare Wi-Fi-Passwort-Schwachstelle in FiberHome GPON ONT-Geräten Referenzen Basierend auf der Forschung von Hanianis ursprüngliche CVE-Veröffentlichung unter CVE-2025-63353 Dank an die Sicherheitsforscher, die diese Schwachstelle identifiziert haben. Rechtlicher Hinweis...

CVE-2025-99999

CVE-2025-99999 - Bypass de Autenticação do Firmware HSM Descrição Bypass crítico de autenticação no Firmware HSM v4.5.0 permitindo extração de chaves. Sistemas Afetados Firmware HSM v4.5.0 todas as compilações Instituições financeiras que utilizam este HSM para assinatura de transações SWIFT IOCs...

CVE-2022-0778

CVE-2022-0778 Descrizione Facciamo riferimento al concetto di drago-96 e poi riscriviamo un PoC basato sui formati P12 e PEM. Puoi usarlo per verificare le vulnerabilità CVE-2022-0778, ovvero un certificato SSL pericoloso senza alcuna password privata, lascialo vuoto. Se il dispositivo è affetto,...

poc-cve-2016-10555

Cambiare l'algoritmo RS256 asimmetrico in HS256 simmetrico - POC CVE-2016-10555 L'algoritmo HS256 utilizza la chiave segreta per firmare e verificare ogni messaggio. L'algoritmo RS256 utilizza la chiave privata per firmare il messaggio e la chiave pubblica per l'autenticazione. Se si cambia...