CVE-2026-86194: Missing Authorization

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-85654

creationtimestamp| type| source ---|---|--- 2026-09-04 22:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupxnu7m6m2m 2026-09-08 18:30:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3muznq5uzq42v 2026-09-08 18:30:05+00:00| seen|...

CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

CVE-2026-85702

creationtimestamp| type| source ---|---|--- 2026-09-04 21:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j74zbtuplef5k 2026-09-09 08:40:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv35a2rqrj2g 2026-09-09 08:40:15+00:00| seen|...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

CVE-2026-85786

creationtimestamp| type| source ---|---|--- 2026-09-04 21:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupuci4ugc22 2026-09-10 02:40:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv4zmdvnk22b 2026-09-10 02:40:41+00:00| seen|...

CVE-2026-80119

creationtimestamp| type| source ---|---|--- 2026-09-04 20:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqxskiz62g 2026-09-10 04:20:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv577dvbel2x 2026-09-10 04:20:47+00:00| seen|...

CVE-2026-80116

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwnrtul2v 2026-09-09 04:40:31+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv2ptqiwjx2b 2026-09-09 04:40:32+00:00| seen|...

CVE-2026-80114

creationtimestamp| type| source ---|---|--- 2026-09-04 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqwgw4gw2g 2026-09-09 07:10:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117239827757083424 2026-09-09 07:10:13+00:00| seen|...

WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability

Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...

CVE-2026-18175

creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkainfhn2z 2026-09-09 22:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mv4kdac7kj2p...

CVE-2026-19274

creationtimestamp| type| source ---|---|--- 2026-09-04 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupijajral2w 2026-09-04 18:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupknjyxry22 2026-09-05 23:01:21+00:00| seen|...

CVE-2026-18149

creationtimestamp| type| source ---|---|--- 2026-09-04 17:24:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w 2026-09-29 23:30:32+00:00| seen| https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5 2026-09-30 12:01:15+00:00| seen|...