CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

EUVD-2026-45123

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

CVE-2026-44453

creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...

CVE-2026-44434

creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...

CVE-2026-62241

creationtimestamp| type| source ---|---|--- 2026-07-17 00:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsidieaof2d 2026-07-17 01:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116932727657867490 2026-07-17 01:30:28+00:00| seen|...

EUVD-2026-45121

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

EUVD-2026-45119

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...

CVE-2026-57076

creationtimestamp| type| source ---|---|--- 2026-07-17 00:03:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsh6birny2m 2026-07-17 01:08:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsktsqhdz27...

CVE-2026-14253

creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...

CVE-2026-45368

creationtimestamp| type| source ---|---|--- 2026-07-16 23:33:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfii3i6n2h...

CVE-2026-44177

creationtimestamp| type| source ---|---|--- 2026-07-16 22:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsdbhwdsg2n...

CVE-2026-52869

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb 2026-08-04 06:51:03+00:00| seen| https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b...

GHSA-JPW9-PFVF-9F58

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...

GHSA-X9F9-R4M8-9XC2 ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

CVE-2026-63086

creationtimestamp| type| source ---|---|--- 2026-07-16 19:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwhp7yyy22...

CVE-2026-34212

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:31+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-17 00:00:47+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-18 04:00:03+00:00| published-proof-of-concept|...

CVE-2026-34213

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:30+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-17 00:00:47+00:00| seen| Telegram/JMPLlqAJKVKStPUctSi0425VFAAqnJlP0EBk3HwzAKEQKc 2026-07-18 04:00:03+00:00| published-proof-of-concept|...

CVE-2026-9090

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:21+00:00| seen| Telegram/KAYuHSInUTyY5sdHqTfJ-t-JAYNMtvmTlSN5y1liuC5CE 2026-07-17 00:00:38+00:00| seen| Telegram/KAYuHSInUTyY5sdHqTfJ-t-JAYNMtvmTlSN5y1liuC5CE 2026-07-18 00:00:22+00:00| published-proof-of-concept|...

CVE-2026-4298

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:19+00:00| seen| Telegram/Rc0b9T17FJVJElH6QZhazeHK5sevkoWVsl-YVplQMonaEk 2026-07-17 00:00:36+00:00| seen| Telegram/Rc0b9T17FJVJElH6QZhazeHK5sevkoWVsl-YVplQMonaEk 2026-07-18 00:00:24+00:00| published-proof-of-concept|...