62358 matches found
CVE-2026-44453
creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...
CVE-2026-44434
creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...
CVE-2026-62241
creationtimestamp| type| source ---|---|--- 2026-07-17 00:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsidieaof2d 2026-07-17 01:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116932727657867490 2026-07-17 01:30:28+00:00| seen|...
EUVD-2026-45121
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
EUVD-2026-45119
The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...
CVE-2026-57076
creationtimestamp| type| source ---|---|--- 2026-07-17 00:03:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsh6birny2m 2026-07-17 01:08:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsktsqhdz27...
PT-2026-60750
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create task of the file executor manager/app/api/v1/tasks.py of the component executor manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...
PT-2026-60643
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
CVE-2026-9810: Improper Privilege Management
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...
CVE-2026-9202: Missing Authentication for Critical Function
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEWUSERISACTIVE=true documented deployment option, newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need...
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...
CVE-2026-14253
creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...
CVE-2026-45368
creationtimestamp| type| source ---|---|--- 2026-07-16 23:33:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfii3i6n2h...
CVE-2026-44177
creationtimestamp| type| source ---|---|--- 2026-07-16 22:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsdbhwdsg2n...
CVE-2026-52869
creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb 2026-08-04 06:51:03+00:00| seen| https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b...
GHSA-JPW9-PFVF-9F58
creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...
GHSA-X9F9-R4M8-9XC2 ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...