PT-2026-66690

Name of the Vulnerable Software and Affected Versions ElementsKit Elementor Addons versions prior to 3.10.01 Description An issue exists where custom-widget definitions saved by users with administrative privileges are written verbatim into a generated PHP file, which is subsequently executed by...

CVE-2026-65887

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

Chatwoot - Installation Detection

Detected chatwoot instance with the initial installation onboarding page accessible at /installation/onboarding, enabling unauthenticated users to create the first Super Admin account and gain full platform control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected chatwoot instance with the...

CVE-2026-65897

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy

CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication...

PT-2026-63977

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65603

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

EUVD-2026-47647

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

PT-2026-63361

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the update user task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from...

CVE-2026-65603: Improper Privilege Management

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

Use Of Hard-coded Cryptographic Key

Kimai is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to the official Docker image using a publicly known default APPSECRET that is neither overridden nor validated, which allows an unauthenticated attacker to forge HMAC-signed cookies and login links to compromise...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233

CVE-2026-62233 affects grav-plugin-api prior to 1.0.6. The issue: createApiKey, generate2fa, and disable2fa endpoints fail to validate super-admin status, allowing non-super api.users.write managers to escalate to super-admin. As described, attackers can mint API keys bound to super-admin account...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

EUVD-2026-45121

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...