EUVD-2025-200110

Grav is vulnerable to Arbitrary File Read...

Grav is vulnerable to Arbitrary File Read

Summary - A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. - This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password reset token. - This can allow an adversar...

PT-2025-48750

Name of the Vulnerable Software and Affected Versions Arcade MCP versions prior to 1.5.4 Description Arcade MCP’s HTTP server uses a hardcoded default worker secret dev that is not validated or overridden during server startup. This allows unauthenticated attackers who know the default key to for...

CVE-2025-66300

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files /grav/user/accounts/.yaml, which store hashed user password, 2FA secret, and the password...

CVE-2025-66300 Grav is vulnerable to Arbitrary File Read

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files /grav/user/accounts/.yaml, which store hashed user password, 2FA secret, and the password...

CVE-2025-66300 Grav is vulnerable to Arbitrary File Read

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files /grav/user/accounts/.yaml, which store hashed user password, 2FA secret, and the password...

PT-2025-48559

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description A user with limited privileges and page editing access can read any server file using the "Frontmatter" form. This includes Grav user account files located at /grav/user/accounts/.yaml, which...

EUVD-2025-199923

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

CVE-2025-66432

In Oxide Control Plane versions 15–17 before 17.1, API tokens can be renewed past their expiration date. This is the core issue; no exploitation details are provided in the documents. The remediation/patch version is not explicitly stated in the supplied materials.

CVE-2025-66432

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

CVE-2025-66432

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

PT-2025-48383

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

Oxide Control Plane 安全漏洞

Oxide Control Plane is an open source console software from Oxide Computer Company. A security vulnerability exists in Oxide Control Plane versions 15 through 17 and prior to 17.1, which stems from the possibility that API tokens may continue to be used after expiration...

CVE-2025-66432

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

CVE-2025-66223

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...

CVE-2025-66223 OpenObserve's Invite Token Lifecycle Misconfiguration

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...

CVE-2025-66223

OpenObserve (cloud-native observability platform) before v0.16.0 is affected by an access-control issue in the invitation token lifecycle. Tokens did not expire, remained valid after a user was removed, and allowed multiple invitations to the same email with different roles—resulting in a removed...

CVE-2025-66223 OpenObserve's Invite Token Lifecycle Misconfiguration

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...

OpenObserve 代码问题漏洞

OpenObserve is a cloud-native observability platform open-sourced by OpenObserve. A code issue vulnerability exists in OpenObserve versions prior to 0.16.0 that stems from improper management of an organization's invitation tokens, which could lead to access control failures...

PT-2025-48364

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...