CVE-2023-41362_MyBB_ACP_RCE

CVE-2023-41362 - MyBB ACP RCE Exploit for CVE-2023-41362 Blog post: https://blog.sorcery.ie/posts/mybbacprce...

CVE-2026-126294

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

CVE-2026-126294 Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

EUVD-2026-125227

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

CVE-2026-126294

The Grav Login plugin (versions before 3.11.0 ) contains an authentication bypass vulnerability. When the global twofa_enabled setting is disabled, an attacker possessing an account password can bypass two-factor verification by using the /login form, a remember-me cookie, or a magic link. This a...

PT-2026-146625

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

cve-2026-86060

CVE-2026-86060 — MikroTik RouterOS SSH Pre-Authentication Privilege Escalation to Full Administrative Control Field| Value ---|--- CVE| CVE-2026-86060 Product| MikroTik RouterOS SSH service Affected versions| RouterOS 6.x and 7.0.0 – 7.23.3 inclusive Fixed versions| RouterOS 7.23.4 and later...

PT-2026-114360

Three critical authentication bypass flaws in Bisheng open-source LLM DevOps platform allow unauthenticated attackers to gain full admin control and expose cross-user data. Technical Breakdown: - CVE-2026-96679 Legacy SSO Bypass: The POST /user/sso endpoint accepts arbitrary usernames in JSON...

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been availab...

CVE-2026-70650 GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

EUVD-2026-91019

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

CVE-2026-70650 GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

PT-2026-103992

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

CVE-2026-73453

An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...

CVE-2026-73453 Security Advisory 0174

An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...

CVE-2026-73453

CVE-2026-73453 is a critical (CVSS 3.1: 10.0) code injection vulnerability (CWE-94 ) in Arista EOS configured with the P4Runtime service. An unauthenticated attacker who can reach the P4Runtime gRPC endpoint (port 9559) can craft a malicious packet during session initiation to achieve arbitrary c...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

Digital Watchdog VMAX DVR and NVR Product Lineups

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. 2. RECOMMENDED PRACTICES CISA recommends...

EUVD-2026-75780

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...