π¨ CVE-2026-75836
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.
π@cveNotify
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.
π@cveNotify
GitHub
MenubarController::executeAction() never enforces the authorize requirement it advertises
## Vulnerability Details
**Component**: getgrav/grav-plugin-api (bundled with Grav 2.0's admin-next/API stack)
**File**: `classes/Api/Controllers/MenubarController.php`
**Lines**: 82-115 (`exe...
**Component**: getgrav/grav-plugin-api (bundled with Grav 2.0's admin-next/API stack)
**File**: `classes/Api/Controllers/MenubarController.php`
**Lines**: 82-115 (`exe...
π¨ CVE-2026-75837
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
π@cveNotify
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
π@cveNotify
GitHub
Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
## Summary
The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (...
The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (...
π¨ CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
π@cveNotify
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
π@cveNotify
GitHub
IN_PLACE hook removal leaves a detached subtree executable, causing XSS
### Summary
During `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onlo...
During `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onlo...
π¨ CVE-2026-75839
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user β including one granted access to only one database or none β can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.
π@cveNotify
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user β including one granted access to only one database or none β can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.
π@cveNotify
GitHub
Raft cluster-info endpoints leak cross-database metadata to any authenticated user (IDOR)
## Summary
On an ArcadeDB HA cluster, the Raft cluster-info endpoints authenticate but do not authorize: they enumerate the full server database registry and return per-database metadata (names, bo...
On an ArcadeDB HA cluster, the Raft cluster-info endpoints authenticate but do not authorize: they enumerate the full server database registry and return per-database metadata (names, bo...
π¨ CVE-2026-75840
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
π@cveNotify
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
π@cveNotify
GitHub
Unescaped Regex in JS Sandbox Package Allowlist Enables Arbitrary Host File Read via Triggers
## Summary
ArcadeDB's GraalVM JavaScript sandbox (used by triggers, functions, and scripted
queries) restricts which Java classes a script may look up via `Java.type(...)`
to a short allow...
ArcadeDB's GraalVM JavaScript sandbox (used by triggers, functions, and scripted
queries) restricts which Java classes a script may look up via `Java.type(...)`
to a short allow...
π¨ CVE-2026-75842
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
π@cveNotify
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
π@cveNotify
GitHub
Cypher LOAD CSV FROM file:// allows arbitrary local file read by any query-capable user
## Summary
Any authenticated user who can run a read query (e.g. the built-in `readonly` group) can read arbitrary files on the ArcadeDB host in the **default** configuration via the OpenCypher `L...
Any authenticated user who can run a read query (e.g. the built-in `readonly` group) can read arbitrary files on the ArcadeDB host in the **default** configuration via the OpenCypher `L...
π¨ CVE-2026-75843
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
π@cveNotify
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
π@cveNotify
GitHub
gRPC external-transaction command path bypasses scripting authorization gate, allowing reader to escalate to server admin
## Summary
The same privilege-escalation class as the HTTP async path exists on the gRPC external-transaction command path. `beginTransaction` creates a dedicated single-thread executor whose lamb...
The same privilege-escalation class as the HTTP async path exists on the gRPC external-transaction command path. `beginTransaction` creates a dedicated single-thread executor whose lamb...
π¨ CVE-2026-75844
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
π@cveNotify
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
π@cveNotify
GitHub
Incomplete fix of CVE-2026-54077 - the IMPORT DATABASE SSRF validator resolves-and-discards
## Summary
Incomplete fix of CVE-2026-54077: the IMPORT DATABASE SSRF validator resolves and checks the hostname but the subsequent connection re-resolves the raw URL and follows redirects, so D...
Incomplete fix of CVE-2026-54077: the IMPORT DATABASE SSRF validator resolves and checks the hostname but the subsequent connection re-resolves the raw URL and follows redirects, so D...
π¨ CVE-2026-75845
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
π@cveNotify
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
π@cveNotify
GitHub
Authorization bypass in ArcadeDB MCP: read-only user can invoke server-admin set_server_setting
## Summary
The recent MCP hardening bound the authenticated principal so **database-level** MCP tools (`execute_command`, `upsert_*`, `query`) enforce the caller's per-user database permission...
The recent MCP hardening bound the authenticated principal so **database-level** MCP tools (`execute_command`, `upsert_*`, `query`) enforce the caller's per-user database permission...
π¨ CVE-2026-75846
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
π@cveNotify
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
π@cveNotify
GitHub
DELETE FUNCTION statement has no permission check allowing any DB user to remove server-side functions
## Summary
`DELETE FUNCTION` executes with no permission check. Any user with database access (no UPDATE_SCHEMA required) can permanently delete any registered server-side function and persist the...
`DELETE FUNCTION` executes with no permission check. Any user with database access (no UPDATE_SCHEMA required) can permanently delete any registered server-side function and persist the...
π¨ CVE-2026-75850
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.
π@cveNotify
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.
π@cveNotify
GitHub
Batch/time-series HTTP handlers skip per-type ACL enforcement because no principal is bound
## Summary
The GHSA-x8mg fix added a coarse `checkAuthorizationOnDatabase` (DB-level `canAccessToDatabase`) to 14 previously-ungated handlers, but it does NOT bind the authenticated principal (`se...
The GHSA-x8mg fix added a coarse `checkAuthorizationOnDatabase` (DB-level `canAccessToDatabase`) to 14 previously-ungated handlers, but it does NOT bind the authenticated principal (`se...
π¨ CVE-2026-75851
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
π@cveNotify
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
π@cveNotify
GitHub
HTTP async command path bypasses scripting authorization gate, allowing reader to escalate to server admin
## Summary
A user with only read access to one database can escalate to server-wide administrator by submitting an asynchronous JavaScript command over HTTP. When a command is submitted with `awai...
A user with only read access to one database can escalate to server-wide administrator by submitting an asynchronous JavaScript command over HTTP. When a command is submitted with `awai...
π¨ CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
π@cveNotify
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
π@cveNotify
GitHub
MongoDB wire protocol does not enforce authentication on the data path, allowing unauthenticated cross-database read/write
## Summary
ArcadeDB's MongoDB wire-protocol plugin implements SASL authentication but does not enforce it on the data path. A client that never authenticates can issue `insert`/`find`/`update`...
ArcadeDB's MongoDB wire-protocol plugin implements SASL authentication but does not enforce it on the data path. A client that never authenticates can issue `insert`/`find`/`update`...
π¨ CVE-2026-75853
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential β even one provisioned for zero or one unrelated database β can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
π@cveNotify
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential β even one provisioned for zero or one unrelated database β can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
π@cveNotify
GitHub
Gremlin wire protocol enforces authentication but no authorization, allowing cross-database read/write and engine ACL bypass
## Summary
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
π¨ CVE-2026-75854
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
π@cveNotify
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
π@cveNotify
GitHub
Redis wire-protocol plugin performs no authentication β unauthenticated read/write/delete on all databases
# Security Advisory β ArcadeDB
**Vulnerability Type:** Missing Authentication for Critical Function β The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
**Vulnerability Type:** Missing Authentication for Critical Function β The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
π¨ CVE-2026-75855
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
π@cveNotify
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
π@cveNotify
GitHub
Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configuredβ¦
## Summary
The `POST /api/v1/server` endpoint's `create database` and `drop database` commands use the caller-supplied database name to build a filesystem path with no sanitization, normaliz...
The `POST /api/v1/server` endpoint's `create database` and `drop database` commands use the caller-supplied database name to build a filesystem path with no sanitization, normaliz...
π¨ CVE-2026-16309
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
π@cveNotify
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
π@cveNotify
siberguvenlik.gov.tr
T.C. Siber GΓΌvenlik BaΕkanlΔ±ΔΔ±
TΓΌrkiye Cumhuriyeti CumhurbaΕkanlΔ±ΔΔ± Siber GΓΌvenlik BaΕkanlΔ±ΔΔ± resmi web sitesi.
π¨ CVE-2026-18751
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
π@cveNotify
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
π@cveNotify
π¨ CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 1978587. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
π¨ CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
bugzilla.mozilla.org
1842361 - (CVE-2026-74975) Download confirmation notification can be overlaid over other origins.
RESOLVED (giorga) in Firefox for Android - Downloads. Last updated 2026-08-17.
π¨ CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
π@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2049034. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.