CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

EUVD-2026-62540

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669

Grav Login Plugin (for Grav CMS) prior to 3.8.11 contains a two-factor authentication bypass in the login.regenerate2FASecret task. The root cause is an insufficient authorization check: the task verifies only that the pending-session user exists rather than requiring $user->authorized. An att...

CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

DEBIAN-CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

AZL-97011 CVE-2026-47187 affecting package fuse-sshfs 3.7.3-1

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

ALPINE-CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

EUVD-2026-62532

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654

CVE-2026-53654 affects the Grav file-based web platform's Login plugin (prior to 3.8.5 ). The twofa_cancel task accepts a client-controlled _redirect field without a nonce, allowing an unauthenticated attacker to set an external http, https, or protocol-relative Location target. The root cause li...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

EUVD-2026-62493

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187

Prior to sshfs 3.7.6, the transform_symlink() mitigation returns early at sshfs.c:2181 without handling relative symlink targets, while sshfs_readlink() (sshfs.c:2234–2236) copies server-supplied targets to the kernel. A rogue SFTP server can thus direct local tools (cp, rsync, editors) to read o...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...