🚨 CVE-2026-62231
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.
🎖@cveNotify
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.
🎖@cveNotify
GitHub
API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
### Summary
The API key system allows scoping keys with a `scopes` array (e.g., `["api.pages.read"]` for a read-only delegate). The scopes are persisted with the key and returned in API ...
The API key system allows scoping keys with a `scopes` array (e.g., `["api.pages.read"]` for a read-only delegate). The scopes are persisted with the key and returned in API ...
🚨 CVE-2026-62237
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.
🎖@cveNotify
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.
🎖@cveNotify
GitHub
Authenticated ReDoS via regex_replace in Twig Sandbox
### Summary
The `regex_replace` filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled `security.twig_content.process_enabled: tr...
The `regex_replace` filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled `security.twig_content.process_enabled: tr...
❤1
🚨 CVE-2026-8616
The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.
🎖@cveNotify
The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.
🎖@cveNotify
🚨 CVE-2026-50425
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50426
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
🎖@cveNotify
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
🎖@cveNotify
🚨 CVE-2025-5318
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
🎖@cveNotify
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
🎖@cveNotify
🚨 CVE-2026-50460
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
❤1
🚨 CVE-2026-50461
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-50462
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50465
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
🎖@cveNotify
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
🎖@cveNotify
🚨 CVE-2026-50466
Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50469
Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50470
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-50471
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-50473
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
🎖@cveNotify
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-50474
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-50476
Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-15457
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
🎖@cveNotify
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
🎖@cveNotify
🚨 CVE-2026-16014
A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
🎖@cveNotify
A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
🎖@cveNotify
🚨 CVE-2026-63094
SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
🎖@cveNotify
SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
🎖@cveNotify
GitHub
Open Redirect via Unvalidated OAuth State URL Leads to Token Exfiltration · Issue #11746 · SigNoz/signoz
(emails sent to security@signoz.io on 23 May and 6 June with no response) There's a potential vulnerability in the SSO authentication flow that allows an unauthenticated attacker to steal sessi...
🚨 CVE-2026-63100
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before_action ensure_admin filter is applied only to the clear_cache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.
🎖@cveNotify
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before_action ensure_admin filter is applied only to the clear_cache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.
🎖@cveNotify
GitHub
oss/maybe.md at main · geo-chen/oss
securing oss responsibly. Contribute to geo-chen/oss development by creating an account on GitHub.