🚨 CVE-2026-75835
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.
🎖@cveNotify
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.
🎖@cveNotify
GitHub
userPassesAuthorize() has two independent unscoped paths, leaking authorize-gated items to scoped API keys
## Vulnerability Details
**Component**: getgrav/grav-plugin-api (bundled with Grav 2.0's admin-next/API stack)
**Files**: `classes/Api/Controllers/AbstractApiController.php` (`userPassesAuthor...
**Component**: getgrav/grav-plugin-api (bundled with Grav 2.0's admin-next/API stack)
**Files**: `classes/Api/Controllers/AbstractApiController.php` (`userPassesAuthor...
🚨 CVE-2026-75840
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
🎖@cveNotify
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
🎖@cveNotify
GitHub
Unescaped Regex in JS Sandbox Package Allowlist Enables Arbitrary Host File Read via Triggers
## Summary
ArcadeDB's GraalVM JavaScript sandbox (used by triggers, functions, and scripted
queries) restricts which Java classes a script may look up via `Java.type(...)`
to a short allow...
ArcadeDB's GraalVM JavaScript sandbox (used by triggers, functions, and scripted
queries) restricts which Java classes a script may look up via `Java.type(...)`
to a short allow...
🚨 CVE-2026-75841
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
🎖@cveNotify
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
🎖@cveNotify
GitHub
`range()` with a large bound exhausts the server heap and causes an `OutOfMemoryError`
### Summary
An authenticated user with permission to execute Cypher queries can submit an oversized `range()` expression that exhausts the server’s configured Java heap and triggers a `java.lang...
An authenticated user with permission to execute Cypher queries can submit an oversized `range()` expression that exhausts the server’s configured Java heap and triggers a `java.lang...
🚨 CVE-2026-75845
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
🎖@cveNotify
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
🎖@cveNotify
GitHub
Authorization bypass in ArcadeDB MCP: read-only user can invoke server-admin set_server_setting
## Summary
The recent MCP hardening bound the authenticated principal so **database-level** MCP tools (`execute_command`, `upsert_*`, `query`) enforce the caller's per-user database permission...
The recent MCP hardening bound the authenticated principal so **database-level** MCP tools (`execute_command`, `upsert_*`, `query`) enforce the caller's per-user database permission...
🚨 CVE-2026-75846
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
🎖@cveNotify
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
🎖@cveNotify
GitHub
DELETE FUNCTION statement has no permission check allowing any DB user to remove server-side functions
## Summary
`DELETE FUNCTION` executes with no permission check. Any user with database access (no UPDATE_SCHEMA required) can permanently delete any registered server-side function and persist the...
`DELETE FUNCTION` executes with no permission check. Any user with database access (no UPDATE_SCHEMA required) can permanently delete any registered server-side function and persist the...
🚨 CVE-2026-75853
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
🎖@cveNotify
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
🎖@cveNotify
GitHub
Gremlin wire protocol enforces authentication but no authorization, allowing cross-database read/write and engine ACL bypass
## Summary
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
🚨 CVE-2026-75854
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
🎖@cveNotify
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
🎖@cveNotify
GitHub
Redis wire-protocol plugin performs no authentication — unauthenticated read/write/delete on all databases
# Security Advisory — ArcadeDB
**Vulnerability Type:** Missing Authentication for Critical Function — The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
**Vulnerability Type:** Missing Authentication for Critical Function — The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
🚨 CVE-2026-74955
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
🎖@cveNotify
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2029265. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-74968
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
🎖@cveNotify
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2055738. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
🎖@cveNotify
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
🎖@cveNotify
bugzilla.mozilla.org
1842361 - (CVE-2026-74975) Download confirmation notification can be overlaid over other origins.
RESOLVED (giorga) in Firefox for Android - Downloads. Last updated 2026-08-17.
🚨 CVE-2026-17084
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
🎖@cveNotify
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
🎖@cveNotify
GitHub
stringprep and IDNA 2003 incorrectly handles some characters · Issue #155292 · python/cpython
Linked PRs gh-155293 gh-156017
🚨 CVE-2026-24301
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-28192
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress Piotnet Addons For Elementor Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28569
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SSL Zen Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
🎖@cveNotify
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress Sync Post With Other Site Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-32465
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
🎖@cveNotify
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Essential Real Estate Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-18534
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
🎖@cveNotify
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
🎖@cveNotify
arc.net
Security Bulletin
Experience a calmer, more personal internet in this browser designed for you. Let go of the clicks, the clutter, the distractions.
🚨 CVE-2026-32472
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
🎖@cveNotify