CVE-2026-65007

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007

The Grav api plugin (grav-plugin-api) prior to v1.0.8 fails to properly authorize API key generation and revocation. It intercepts apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes callers solely on admin.login, the baseline permission for all panel use...

Exploit for CVE-2026-9198

CVE-2026-9198 — Langflow OSS Unauthenticated RCE Unauthentica...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

[SECURITY] Fedora 43 Update: openssh-10.0p1-11.fc43

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

PT-2026-62009

Name of the Vulnerable Software and Affected Versions HCL MyCloud affected versions not specified Description A concurrent login issue exists that may increase the risk of unauthorized access, session hijacking, and account misuse. Recommendations At the moment, there is no information about a...

PT-2026-62634

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN eSettlements version 9.2 Description A flaw in the eSettlements component allows a high-privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead ...

CVE-2026-56583: Insufficient Session Expiration

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover

WordPress Login Customizer plugin version 2.5.3 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affect...

PT-2026-61929

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

PT-2026-62263

Name of the Vulnerable Software and Affected Versions MySQL Server versions 9.7.0 through 9.7.1 MySQL Cluster versions 9.7.0 through 9.7.1 Description A flaw in the Server: Configurator component allows a low privileged attacker with access to the infrastructure where the software executes to...

PT-2026-62967

Vulnerability in Oracle GoldenGate component: Libraries. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise...

PT-2026-62243

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description An issue in the Core component allows an unauthenticated attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation requires human...

PT-2026-63281

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the OAuth2 sign-in callback that allows a deactivated user account to be reactivated when signing in through an authentication source that does not issue refresh tokens, such...

CVE-2026-59851: Incorrect Authorization

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

CVE-2026-64822: Observable Discrepancy

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Booking Activities 1.16.43 Authentication Bypass

WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...