104689 matches found
CVE-2026-20357
Cisco Crosswork has multiple missing-authentication vulnerabilities (CWE-306) in critical functions, rated CVSS 10.0 (network, no privileges required). No specific affected versions or fix details are provided in the documents; exploitation status is also not available. Monitor the Cisco security...
CVE-2026-20357 Cisco Crosswork Security Hardening Release: August 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...
EUVD-2026-62565
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...
CVE-2026-62666
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...
MINI-QPHW-6JXF-XGR6
Bulletin has no description...
MINI-5QXQ-MW4F-JRJX
Bulletin has no description...
CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user c...
MINI-GR56-HP3J-Q8XV
Bulletin has no description...
MINI-P9FW-F7CJ-PX9H
Bulletin has no description...
EUVD-2026-62539
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...
MINI-6G2F-H297-6J9J
Bulletin has no description...
EUVD-2026-62537
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...
CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...
CVE-2026-62670
CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...
cve-lab-journal
CVE Lab Journal !CVEs loggedhttps://img.shields.io/badge/C...
CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...
CVE-2026-58565
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-58562
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
DEBIAN-CVE-2026-47187
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...