{"vulnerability": "CVE-2026-7582", "sightings": [{"uuid": "410dff0f-1634-483e-a127-45f0cd81ab9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtedqcdgjl23", "content": "CVE-2026-75827 - grav\nGrav, a content management system, has a security flaw that allows hackers with editing or configuration access to inject malicious code into any file on the website. This can lead to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-18T13:40:03.997404Z"}, {"uuid": "da892349-f372-49c8-b2e0-2b5af85f0c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtedqdnqzd23", "content": "CVE-2026-75828 - grav\nGrav, a content management system, has a security flaw that lets attackers inject malicious code into pages. This could allow them to take control of visitors' browsers, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-18T13:40:05.120679Z"}, {"uuid": "c7206fc8-6e58-49be-94c5-d8b938c0555f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtefbakr6d2e", "content": "\ud83d\udea8 CVE-2026-75827 \u2014 CVSS 9.3 CRITICAL\n\nGrav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-functi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75827\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T14:07:25.982674Z"}, {"uuid": "df3eb523-900e-4f4d-8972-01b6cf201318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtefbit4x62j", "content": "\ud83d\udea8 CVE-2026-75828 \u2014 CVSS 9.3 CRITICAL\n\nGrav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75828\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T14:07:34.902164Z"}, {"uuid": "61ba78f4-e464-46b3-bdc8-797e3c1ac136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7582", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mo6vmkuwkk26", "content": "Linux e seguran\u00e7a: vulnerabilidade cr\u00edtica no OpenImageIO (CVE-2026-7582) permite execu\u00e7\u00e3o remota de c\u00f3digo. Script de corre\u00e7\u00e3o, comandos de verifica\u00e7\u00e3o e mitiga\u00e7\u00e3o alternativa no nosso guia perene. Saiba mais: ->  tinyurl.com/4vxdeh87 #Fedora", "creation_timestamp": "2026-06-13T18:38:13.187565Z"}, {"uuid": "736e5781-0df2-4628-a847-7f524a2ca280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7582", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mo6vmmqnos26", "content": "Linux e seguran\u00e7a: vulnerabilidade cr\u00edtica no OpenImageIO (CVE-2026-7582) permite execu\u00e7\u00e3o remota de c\u00f3digo. Script de corre\u00e7\u00e3o, comandos de verifica\u00e7\u00e3o e mitiga\u00e7\u00e3o alternativa no nosso guia perene. Saiba mais: ->  tinyurl.com/4vxdeh87 #Fedora", "creation_timestamp": "2026-06-13T18:40:23.793908Z"}, {"uuid": "a626b7be-723e-4be9-b105-29ca04f0270b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "seen", "source": "https://gist.github.com/alon710/1cef33c0330b102b29081dbdebfcc5c4", "content": "# CVE-2026-75827: CVE-2026-75827: Grav Arbitrary File Write & Remote Code Execution\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75827\n\n## Summary\nAn arbitrary file write and remote code execution vulnerability exists in Grav CMS before version 2.0.15. The vulnerability is caused by using an incomplete denylist validation approach for bare PHP functions in the Blueprint dynamic-data compiler, allowing authenticated users with page-editing or blueprint-configuration privileges to execute arbitrary functions such as error_log.\n\n## TL;DR\nIncomplete denylist validation of bare PHP functions in Grav Blueprints allows authenticated users to trigger arbitrary file writes and achieve remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.8 (High)\n- **EPSS Score**: 0.00777\n- **Exploit Status**: PoC Verified\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS Core\n- **Grav CMS Core**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade Grav CMS Core to version 2.0.15 or later.\n- Audit page frontmatter files for unauthorized dynamic data directives.\n- Deploy Web Application Firewall (WAF) filtering on blueprint configurations.\n\n**Remediation Steps:**\n1. Identify and document all active Grav CMS installations and their current versions.\n2. Download and deploy Grav Core 2.0.15 or subsequent security releases.\n3. Run audit scripts to scan for unauthorized dynamic directives in existing pages.\n4. Enable provenance-based trust mechanisms by locking down writable page directory configurations.\n\n## References\n\n- [Grav CMS Advisory GHSA-f8wv-xp27-6gq7](https://github.com/getgrav/grav/security/advisories/GHSA-f8wv-xp27-6gq7)\n- [NVD CVE-2026-75827 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-75827)\n- [VulnCheck Vulnerability Advisory](https://www.vulncheck.com/advisories/grav-before-arbitrary-file-write-via-error-log)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75827) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T00:31:13.245503Z"}, {"uuid": "27aded79-ad57-4645-85d8-4577ec73f2fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://gist.github.com/alon710/921970bf6a85809e6ae612195bf792e8", "content": "# CVE-2026-75828: CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75828\n\n## Summary\nCVE-2026-75828 is a critical stored cross-site scripting (XSS) vulnerability in the getgrav Grav CMS before version 2.0.15. The vulnerability resides in the detectXss() security filter mechanism, where parser-differential mismatches between the regular-expression-based server-side validation and browser HTML5 tokenization allow authenticated editors to bypass event-handler detection and inject arbitrary JavaScript execution vectors.\n\n## TL;DR\nA parser-differential flaw in Grav CMS's detectXss() filter allows authenticated editors to bypass event-handler detection using unpaired quotes in unquoted attribute values, resulting in stored cross-site scripting.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: 0.00343\n- **Impact**: Stored Cross-Site Scripting (XSS) leading to Session Hijacking / RCE\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS\n- **grav**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade the Grav Core installation to version 2.0.15 or higher.\n- Apply the regex hotfix to system/src/Grav/Common/Security.php to anchor quote matching to the assignment operator.\n- Implement Web Application Firewall (WAF) inspection to reject payload sequences containing malformed HTML tags.\n\n**Remediation Steps:**\n1. Navigate to the Grav root directory on the hosting server.\n2. Execute the CLI self-upgrade command: bin/gpm self-upgrade\n3. Verify the version in system/src/Grav/Common/Security.php to ensure the updated regex configurations are active.\n\n## References\n\n- [Grav GitHub Security Advisory](https://github.com/getgrav/grav/security/advisories/GHSA-vfmf-q6x9-cw96)\n- [VulnCheck Third-Party Advisory](https://www.vulncheck.com/advisories/grav-before-stored-xss-via-detectxss-quote-bypass)\n- [Grav Core Security Fix Commit](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd)\n- [Raw Git Patch Reference](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd.patch)\n- [Official CVE Entry](https://www.cve.org/CVERecord?id=CVE-2026-75828)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T01:31:36.584153Z"}, {"uuid": "399d34fa-c564-4d27-b8f4-13e180900d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "seen", "source": "https://t.me/GithubRedTeam/102702", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75827\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a abraxas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 17:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75827 - getgrav - High 8.8 - Unauthenticated GET /poc-form - Arbitrary File Write\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-18T20:00:03.983624Z"}, {"uuid": "aebdbebb-d9a2-4807-a754-6c0b3c3f6d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102702", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75827\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a abraxas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 17:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75827 - getgrav - High 8.8 - Unauthenticated GET /poc-form - Arbitrary File Write\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-19T00:00:10.126529Z"}]}