CyberRange

Overview: This CyberRange project represents the first open-source Cyber Range blueprint in the world. This project provides a bootstrap framework for a complete offensive, defensive, reverse engineering, & security intelligence tooling in a private research lab using the AWS Cloud. This project...

CVE-2026-75827

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75827 CVE-2026-75827 Grav 2.0.13 - getgrav I am @abraxasnull. Loopback lab. The client is CVE-2026-75827-Abraxas-Labs.py. The denylist missed errorlog. Grav through 2.0.14 allowlists Class::method dynamic-dat...

CVE-2026-104059

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the admin API blueprint . The root cause is a lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting. This allows unauthenticated attackers to perform ...

EUVD-2026-91007

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-concept for CVE-2026-65008 : authenticated remote code execution in Grav CMS via unrestricted calluserfuncarray in Blueprint::dynamicData. A user with admin.pages or api.pages.write can plant a malicious form frontmatter. The payload then...

DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-

= doi.org/10.5281/zenodo.18287026 = orcid.org/0009-0007-7728-256X Project: DDoS Purple Elite Teaming Exhaustive Analysis 2026 Author: SASTRAADIWIGUNA PurpleEliteTeaming ⚠️ MANDATORY LEGAL DISCLAIMER This repository and its documentation are strictly for educational, defensive, and authorized...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

Improper Privilege Management

Grav is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient access restrictions on the access field in the core group blueprint, which allows a delegated admin.users operator to grant themselves super-admin privileges and gain access to scheduler and Twig...

EUVD-2026-60601

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin...

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

GHSA-7PGQ-CR25-XVC8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

GHSA-2C4F-86XC-CR74 Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Summary The XSS blueprint validator Security::detectXss runs on the raw page content before Twig processing. An attacker can use Twig's string concatenation operator to dynamically construct an event handler name at render time. The validator sees "on" "error" - a harmless Twig expression - and...