{"vulnerability": "CVE-2026-6223", "sightings": [{"uuid": "cb968fe8-f200-42ee-811c-3d4e34ff4c11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62234", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtijttg3sm2p", "content": "CVE-2026-62234 - grav\nGrav webhooks before version 2.0.4 allow authorized users to access local files and potentially sensitive information. This can happen when a malicious user creates a webhook with a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-20T05:40:03.940417Z"}, {"uuid": "90905be0-6c07-4ca3-b20e-d875ce0f0561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62233", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmjso4lsr2m", "content": "CVE-2026-62233 - grav-plugin-api\nA non-admin user can create a super-admin account and bypass two-factor authentication in the Grav API Plugin. This is fixed in version 1.0.6. Update to the latest version to ensure\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#getgrav #CVE #infosec", "creation_timestamp": "2026-08-21T19:50:03.727119Z"}, {"uuid": "a79840e5-3827-48b4-aa0a-5e9d1cf5ef67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62233", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtocaperzd2f", "content": "CVE-2026-62233 - grav\nThe Grav Plugin API version 1.0.6 or earlier does not properly check user permissions for certain API requests. This allows unauthorized users to gain super-admin access and potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-22T12:40:04.441083Z"}, {"uuid": "86b18898-5e99-4d09-ba7e-1a3d4caf9d8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62239", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqknqhs2p22t", "content": "CVE-2026-62239 - FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py\nCVE ID : CVE-2026-62239\n \n Published : July 13, 2026, 9:03 p.m. | 26\u00a0minutes ago\n \n Description : FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vul...", "creation_timestamp": "2026-07-13T21:39:30.604630Z"}, {"uuid": "28007d33-2309-4847-a916-82494cccd490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62232", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqsqbhg4qj2v", "content": "CVE-2026-62232 - grav\nGrav versions before 2.0.4 have a security weakness that allows attackers to bypass the extra protection of 2-factor authentication. This means that even with an extra verification step,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-07-17T02:46:05.745567Z"}, {"uuid": "4ad85a41-f260-4f94-a4ed-312e15222d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62233", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqoxkcre2u", "content": "CVE-2026-62233 - grav-plugin-api\nCVE ID : CVE-2026-62233\n \n Published : July 17, 2026, 2:18 a.m. | 16\u00a0minutes ago\n \n Description : grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.u...", "creation_timestamp": "2026-07-17T02:53:39.135268Z"}, {"uuid": "749fa97f-2480-435b-9009-8ed5eb9e3da4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-62232", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116933081864341410", "content": "CVE-2026-62232 (CRITICAL): getgrav Grav <2.0.4 has a 2FA bypass flaw \u2014 attackers knowing a user's password can overwrite the 2FA secret, reducing protection to password-only. Monitor & restrict access. Patch status pending. https://radar.offseq.com/threat/cve-2026-62232-missing-authorization-in-getgrav-gr-604d58721f0c378d #OffSeq #CVE202662232 #2FA #infosec", "creation_timestamp": "2026-07-17T03:00:31.343944Z"}, {"uuid": "d44f325c-259a-4f6d-ab8e-6e813a76b944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-62232", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqsr3bz3zw2t", "content": "Grav <2.0.4 hit by a CRITICAL vulnerability: attackers with a valid password can reset user 2FA secrets, bypassing multi-factor auth. Restrict access, monitor 2FA changes, and check for patches. https://radar.offseq.com/threat/cve-2026-62232-missing-authorization-in-getgrav-gr-604d58721f0c378d #O...", "creation_timestamp": "2026-07-17T03:00:34.023427Z"}, {"uuid": "58d0df1c-6a89-4fe5-b41f-296752769a36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62230", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqsrs36hcw2w", "content": "CVE-2026-62230 - Grav\nCVE ID : CVE-2026-62230\n \n Published : July 17, 2026, 2:18 a.m. | 16\u00a0minutes ago\n \n Description : Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, ...", "creation_timestamp": "2026-07-17T03:13:17.346847Z"}, {"uuid": "05115b05-5181-4499-8cb6-14fce69fabca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62234", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqss2zusdv2o", "content": "CVE-2026-62234 - Grav\nCVE ID : CVE-2026-62234\n \n Published : July 17, 2026, 2:18 a.m. | 16\u00a0minutes ago\n \n Description : Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks wi...", "creation_timestamp": "2026-07-17T03:18:17.865896Z"}, {"uuid": "18a8c2ab-0a1a-4dc1-9cf3-2478065027f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62232", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqssdyfti62i", "content": "CVE-2026-62232 - Grav\nCVE ID : CVE-2026-62232\n \n Published : July 17, 2026, 2:18 a.m. | 16\u00a0minutes ago\n \n Description : Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence...", "creation_timestamp": "2026-07-17T03:23:18.372029Z"}, {"uuid": "d63b1e34-7b5e-4316-8889-801cc30de157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62231", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqssvvbovb2s", "content": "CVE-2026-62231 - Grav\nCVE ID : CVE-2026-62231\n \n Published : July 17, 2026, 2:18 a.m. | 16\u00a0minutes ago\n \n Description : The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ...", "creation_timestamp": "2026-07-17T03:33:19.001383Z"}, {"uuid": "d3189248-9a63-488b-98cc-390ff453f8c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62234", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqywvhya4v23", "content": "\ud83d\udfe0 CVE-2026-62234 - High (8.1)\n\nGrav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated us...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-62234/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-19T14:00:38.775171Z"}, {"uuid": "af0c9fd7-7fab-4681-ac85-9ab531b31e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6223", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117229881004981941", "content": "CRITICAL vuln: CVE-2026-6223 in Bah\u00e7elievler Municipality BiHayat App (v2.1.7+) enables authentication bypass via weak brute-force protections. No vendor fix yet. Assess and strengthen your controls. https://radar.offseq.com/threat/cve-2026-6223-cwe-307-improper-restriction-of-excessive-authentication-attempts-in-bahelievler-e94a3e6ad304a991 #OffSeq #CVE20266223 #Infosec #AppSec", "creation_timestamp": "2026-09-07T13:00:26.904707Z"}, {"uuid": "67855ebf-a8c0-439a-a45c-a68d469650c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6223", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3muwktvxnox24", "content": "CVE-2026-6223: Bah\u00e7elievler BiHayat App (v2.1.7+) has a CRITICAL auth bypass flaw \u2014 improper brute-force protection. No patch yet. Tighten access controls and monitor logins. https://radar.offseq.com/threat/cve-2026-6223-cwe-307-improper-restriction-of-excessive-authentication-attempts-in-bahelie...", "creation_timestamp": "2026-09-07T13:00:28.973948Z"}, {"uuid": "6b2f27fb-59ea-4dca-8999-e7fcf41d5dc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6223", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muwolhdjws2j", "content": "\ud83d\udea8 CVE-2026-6223 \u2014 CVSS 9.4 CRITICAL\n\nImproper restriction of excessive authentication attempts vulnerability in Bah\u00e7elievler Muncipality BiHayat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-6223\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-07T14:07:19.254199Z"}, {"uuid": "daf2f398-1e0f-401c-a819-c4d6ea923596", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6223", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muz2qcabjj2j", "content": "CVE-2026-6223 - bihayat app\nThe BiHayat mobile app for Bah\u00e7elievler Municipality (versions 2.1.7 through 07092026) does not limit how many times a user can try to log in, letting an attacker get past the login\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bihayatapp #CVE #infosec", "creation_timestamp": "2026-09-08T12:50:06.101569Z"}]}