{"vulnerability": "CVE-2026-6266", "sightings": [{"uuid": "2f47a04c-23fa-4576-bfed-de2ccbe24de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62663", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mruzhjareg2e", "content": "\ud83d\udfe0 CVE-2026-62663 - High (7.5)\n\nBanks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-62663/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-30T18:01:04.562812Z"}, {"uuid": "969493b7-c4f8-4c77-b962-6e3bcf39626b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6266", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzvirjkz22f", "content": "\ud83d\udfe0 CVE-2026-6266 - High (8.3)\n\nA flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automati...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6266/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T14:37:09.589600Z"}, {"uuid": "fad4998e-6030-4ac5-b633-25b5b763386f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6266", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzvj7p6p52s", "content": "\ud83d\udfe0 CVE-2026-6266 - High (8.3)\n\nA flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automati...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6266/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T14:37:24.047045Z"}, {"uuid": "45c10fd5-c252-40c5-955c-301df1f6eb27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6266", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzvlc5esy2t", "content": "\ud83d\udfe0 CVE-2026-6266 - High (8.3)\n\nA flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automati...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6266/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T14:38:33.437691Z"}, {"uuid": "e17d3e65-faba-414c-a623-b1316620c55f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6266", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml24qpp75o2p", "content": "CVE-2026-6266 - Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking\nCVE ID : CVE-2026-6266\n \n Published : May 4, 2026, 2:16 p.m. | 2\u00a0hours, 4\u00a0minutes ago\n \n Description : A flaw was found in the AAP gateway. The user auto-link st...", "creation_timestamp": "2026-05-04T16:46:51.891638Z"}, {"uuid": "ebcf7eca-ea9b-4f33-9603-b2d0864df69e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62668", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthdalebxe2p", "content": "\ud83d\udea8 CVE-2026-62668 \u2014 CVSS 9.4 CRITICAL\n\nGrav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Pr...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-62668\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T18:09:15.633024Z"}, {"uuid": "56a63137-91c9-4f52-961f-0c87cddbd8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62668", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mthhr5af5y2e", "content": "CVE-2026-62668 - grav\nGrav API Plugin, used in Grav CMS, allows unauthorized access to local files and internal services if an attacker with 'api.webhooks.write' permission submits a malicious webhook URL. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-19T19:30:06.177481Z"}, {"uuid": "ebf153ff-ba32-4fba-8d93-dc3f13c0c60d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62669", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mul3p4uzs42m", "content": "CVE-2026-62669 - grav\nAn outdated version of the Grav Login Plugin allows attackers to bypass two-factor authentication. This means an attacker can log in without the second security code, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-09-02T23:30:04.976940Z"}, {"uuid": "9c0114d3-fe7b-471e-a400-d81c53baf255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-62669", "type": "published-proof-of-concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3", "content": "", "creation_timestamp": "2026-09-03T00:35:07.237881Z"}, {"uuid": "b19057cc-1fed-42f6-875e-3f296cbf04b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62669", "type": "seen", "source": "https://gist.github.com/alon710/fb22df514827698e37bf556e10bb1199", "content": "# CVE-2026-62669: CVE-2026-62669: Critical Two-Factor Authentication Bypass in Grav CMS Login Plugin\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62669\n\n## Summary\nCVE-2026-62669 is a critical Improper Authentication vulnerability (CWE-287) in the Grav Login Plugin for Grav CMS. Prior to version 3.8.11, the plugin's key rotation task failed to verify if a user session was fully authorized before regenerating and returning two-factor authentication (2FA) secrets. Consequently, an attacker possessing a victim's primary credentials could invoke this endpoint to replace the 2FA secret, retrieve the replacement, and bypass the MFA constraint entirely.\n\n## TL;DR\nA logical validation flaw in the Grav Login Plugin allows an attacker with valid primary credentials to out-of-band regenerate and read the victim's 2FA secret, successfully bypassing multi-factor protection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.4 (High)\n- **EPSS Score**: 0.00386\n- **Impact**: Two-Factor Authentication Bypass\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS Core\n- Grav Login Plugin\n- **grav-plugin-login**: < 3.8.11 (Fixed in: `3.8.11`)\n- **grav**: < 2.0.4 (Fixed in: `2.0.4`)\n\n## Mitigation\n\n- Upgrade the Grav Login Plugin to version 3.8.11 or higher.\n- Upgrade Grav CMS Core to version 2.0.4 or higher.\n- Deploy WAF rules to restrict access to the task:login.regenerate2FASecret endpoint.\n\n**Remediation Steps:**\n1. Navigate to the Grav CMS administration panel.\n2. Access the 'Plugins' management tab.\n3. Locate the 'Login' plugin and trigger the update action to retrieve version 3.8.11.\n4. If utilizing command-line administration, execute: bin/gpm update login\n5. Verify the update succeeded and test login flows to ensure session state persists properly.\n\n## References\n\n- [GitHub Security Advisory GHSA-7mgc-c7pq-3rr3](https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3)\n- [Grav Commit 5d1b722298cb](https://github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630)\n- [Grav Login Plugin Release 3.8.11](https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11)\n- [Grav CMS Release 2.0.4](https://github.com/getgrav/grav/releases/tag/2.0.4)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-62669)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62669) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T14:32:32.686913Z"}, {"uuid": "f9970571-d703-421f-b871-6e67a7665d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6266", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n  \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n  \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n  \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n  \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n  \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n  \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n  \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n  \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n  \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n  \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n  \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n  \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n  \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n  \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n  \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n  \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n  \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n  \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:17.522384Z"}]}