268048 matches found
EUVD-2026-97619
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109314
The Grav Login plugin (versions 1.2.0 before 3.9.9) is vulnerable to an information disclosure flaw. A publisher can author a page at the reset route, causing the Login::getPage() function to render a publisher-controlled page when a victim clicks an emailed password reset link. This action expos...
CVE-2026-109313
The Grav Login plugin (versions 2.7.0 before 3.9.9 ) is vulnerable to an authentication bypass (CWE-287). Attackers possessing a valid password can bypass two-factor authentication (2FA) by exploiting the remember-me cookie restoration mechanism. By obtaining a persistent remember-me cookie after...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...
CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...
CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...
sendnn-inference (>=2.6.0, <=2.6.3), tq-quant (0.3.3) +1 more potentially affected by CVE-2026-109311 via vllm (>=0.27.1, <=0.28.0)
vllm PYPI version =0.27.1, =2.6.0, =2.6.3 - tq-quant 0.3.3 - vllm-beam-search-plugin 0.1.4 Source cves: CVE-2026-109311 Source advisory: MEND:CVE-2026-109311...
EUVD-2026-97611
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...
CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...
WordPress Web Vitals Tracking plugin <= 5.4.2 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Web Vitals Tracking versions = 5.4.2...
WordPress Crowdfundly plugin <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation vulnerability
Crowdfundly Manager+ Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Crowdfundly versions = 2.2.2...
WordPress Freeton WP plugin <= 1.0.0 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Freeton WP versions = 1.0.0...
CVE-2026-63492
The helper "listFFmpegProcesses$keyword" in "plugin/API/standAlone/functions.php" builds a shell pipeline by interpolating "$keyword" inside single quotes and running it with "exec": The two callers in "plugin/API/standAlone/ffmpeg.json.php" the "list" mode and the "isKeywordRunning" mode pass th...
CVE-2026-63494
The standalone FFmpeg execution endpoint "plugin/API/standAlone/ffmpeg.json.php" builds a shell command string that is passed to "execAsync" and run via "nohup sh -c """. When the decrypted "codeToExec" payload produces a non-empty "avideoPath", the endpoint appends a completion hook of the form:...
WordPress Envira Gallery plugin < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability
Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...
WordPress LTL Freight Quotes plugin 4.2.11-4.2.18 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.11-4.2.18...