CVE-2026-57579: Missing Authorization

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...

CVE-2026-75830

grav-plugin-api (getgrav/grav-plugin-api) versions 1.0.0-beta.10 through 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for a prior advisory (GHSA-qjq4-jp55-4mx2) left the user-controlled suffix parameter in POST /api/v1/pages/batch unv...

CVE-2026-75830: External Control of File Name or Path

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72824

CVE-2026-72824 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 . The root cause is an API key scope-cap bypass in PagesController::guardTwigContent(): the Twig-toggle check relies on a bare isSuperAdmin() gate without consulting api_key_scopes. A least-privilege API key scoped...

CVE-2026-72824: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

OS Command Injection Via Arbitrary File Upload

baserproject/basercms is vulnerable to OS command injection. The vulnerability exists due to the lack of validation checks in PagesController.php, allowing a remote attacker to inject specially crafted data to the application and execute arbitrary OS commands on the system...

mooSocial 1.3 - Multiple Vulnerabilites

No description provided by source. Exploit Title: mooSocial 1.3 - Multiple Vulnerabilites Official site: http://www.moosocial.com Risk Level: High Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 22/08/2013 +----------+ | OVERVIEW | +----------+ mooSocial is a social networking...