2812 matches found
CVE-2026-85602
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
EUVD-2026-71025
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
PT-2026-85502
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-85602: Reliance on Untrusted Inputs in a Security Decision
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
Introducing More Granular Controls for AI Bot Traffic
...
CVE-2026-12555
creationtimestamp| type| source ---|---|--- 2026-09-02 21:28:09+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mukuv3x3nm2j 2026-09-03 10:54:31+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3mumbwz6dok26 2026-09-03 14:01:09+00:00| seen|...
invisible_playwright v0.7.2
Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...
Ciphey v0.12.1
Ciphey Paste in text that's been encoded or encrypted. Ciphey works out how and hands you the plaintext. No key, no cipher name, no hints. Base64, hex, Caesar/ROT13, Vigenère, Morse code and 19 more, several layers deep. Install · Quick start · Features · Library · MCP · Docs · Discord ▶ Watch th...
EUVD-2026-68230
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
PT-2026-83570
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
CVE-2026-68929
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...
EUVD-2026-67310
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...
PT-2026-82775
Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2 Description WeChat iLink share-channel endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. Because the shareId is exposed in shared chat URLs,...
TCGuard
TCGuard — Universal Crash, Exploit, Packet & Anti-Bot Protecti...
GO-2026-6279 Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server
Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server...
Malicious code in minecraft-ytreceiver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...
MAL-2026-14516 Malicious code in minecraft-ytreceiver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...