CVE-2026-62235

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...

CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

EUVD-2026-45118

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Proxmox VE is affected: incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API. The root cause is an access-control issue in the cloudinit/dump endpo...

Langflow AI auto_login RCE

Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/autologin with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Module Options msf use...

RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the...

ROS-20260717-73-0038

The vulnerability of the Resource Timing application programming interface in Google Chrome and Microsoft Edge browsers is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected informati...

PT-2026-60863

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Authenticated users can override component parameters at runtime via the API. This is caused by a flaw in the parameter filtering mechanism within the apply tweaks function...

PT-2026-60793

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before action ensure admin...

PT-2026-60774

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment qemu-server versions 9.x prior to 9.1.8 Proxmox Virtual Environment qemu-server versions 8.x prior to 8.4.8 Description Incorrect access control allows users with limited privileges to obtain hashed passwords throug...

RabbitMQ 3.13.x < 3.13.14 / 4.0.x < 4.0.19 / 4.1.x < 4.1.10 / 4.2.x < 4.2.5 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - The rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths because readcompletebody checks the accumulated size before the final chunk but not the final...

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...

VulnCheck KEV: CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-44177

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

CVE-2026-44175

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting XSS. Kirby's list field stores its formatted content as HTML, and unlike other field types...