CICD-Goat-Vapt-Writeup — Updated!

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...

CVE-2026-8347 — Updated!

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

CGA-PG7R-WXWM-HH72

Bulletin has no description...

CGA-43XQ-FXGM-73C7

Bulletin has no description...

GHSA-G29J-RWFV-H99W Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Summary com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names into URLs via Spring's ResourceLoader without applying the path-containment check that protects every other URL-based loader in the project ClassPathTemplateLoader, FileTemplateLoader,...

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Summary com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves Spring MVC view names into URLs via Spring's ResourceLoader without applying the path-containment check that protects every other URL-based loader in the project ClassPathTemplateLoader, FileTemplateLoader,...

EUVD-2026-63392

Handlebars.java: Arbitrary file read in SpringTemplateLoader via URL-fragment suffix bypass...

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...

GHSA-MVXR-6M87-MV2Q Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...

EUVD-2026-62540

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...

GHSA-7MGC-C7PQ-3RR3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...

CGA-QP2H-3WQ3-FH7R

Bulletin has no description...

CGA-X8XV-GWC7-P9RP

Bulletin has no description...

CGA-P3WH-8VPR-J7X9

Bulletin has no description...

CGA-9CH7-86GX-3JH6

Bulletin has no description...

EUVD-2026-62535

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter CVE-2026-44738 bypass...

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

GHSA-MC5Q-6HPJ-RP7J Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

CVE-2026-30951 — Updated!

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 Overview CVE-2026-30951 is a SQL Injection vulnerability in Sequelize v6 , a widely used Node.js ORM. The vulnerabili...