Grav API plugin allows account takeover via Host header spoofing

🕵️ RESEARCH & DEEP DIVES

• Grav API plugin before 1.0.20 lets attackers hijack password resets via spoofed Host header (CVE-2026-86196)
  The Grav CMS API plugin before 1.0.20 is vulnerable to account takeover via Host header spoofing in its forgot-password endpoint (CVE-2026-86196).

  • Affects Grav CMS sites running the getgrav grav-plugin-api RESTful API plugin in versions before 1.0.20.
  • The forgot-password endpoint builds password reset links from the untrusted Host header, letting unauthenticated attackers redirect reset tokens to attacker-controlled domains.
  • Attackers send a reset request for any account with a malicious Host header, intercept the token from the victim's email, and complete account takeover — including super-admin accounts.
  • CVE-2026-86196 scores 8.7 (CVSS 4.0, network vector, no privileges required) and was assigned by VulnCheck; fixed in version 1.0.20.
  • The same plugin version 1.0.20 also fixes a related privilege escalation (CVE-2026-86195) where dot-keyed api.super flags bypass invitation super-flag stripping.
    📄 Source: github.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt

• AVideo YPTSocket plugin vulnerable to unauthenticated XSS via websocket callbacks (CVE-2026-86188)
  WWBN AVideo with the YPTSocket plugin enabled contains an unauthenticated cross-site scripting vulnerability (CVE-2026-86188).

  • Affects AVideo instances running the YPTSocket plugin; any unauthenticated remote attacker can exploit it
  • Crafted socket messages with callback names resolving to global functions like avideoConfirmHTML assign untrusted data to innerHTML in the victim's origin
  • Script execution requires no authentication and no user interaction
  • Scored CVSS 3.1 7.2 (high) / CVSS 4.0 6.9 (medium), CWE-79; credited to researcher rajivraj
    📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• ugrep before 7.6.0 heap buffer over-read in LZW .Z decompression (CVE-2025-15614)
  ugrep versions before 7.6.0 contain a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files.

  • Affects Genivia ugrep, any version before 7.6.0 (CVE-2025-15614, tracked as CWE-125 out-of-bounds read).
  • The LZW decompressor reads one byte past the end of an allocated heap buffer when handling malformed .Z files, potentially crashing the process.
  • Attack vector is local with user interaction: an attacker supplies a crafted .Z file that ugrep decompresses; the vulnerable getcode() read is at src/zopen.c:673 in v7.5.0.
  • Severity is medium: CVSS 4.0 score 4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) and CVSS 3.1 score 3.3, with availability impact only.
  • Reported by Vlatko Kosturjak (GitHub issue #511); fixed via commit c12849a11264e2c81c860bf78ee9039772f307a4 in the ugrep 7.6.0 release.
    📎 Coverage: vulncheck.com · 👁 via CVE ThreatInt

📰 UNDER-REPORTED

• Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites — SecurityWeek

• grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super... — CVE ThreatInt

• Grav Form Plugin before 9.1.22 Cross-Page Form ExecutionGrav Form Plugin befo... — CVE ThreatInt

• Grav API Plugin Authentication Bypass via Group-Inherited Supergrav-plugin-ap... — CVE ThreatInt

• SiYuan before v3.8.2 Information Disclosure via Attribute-ViewSiYuan versions... — CVE ThreatInt

• SiYuan before v3.8.2 Private Attribute View Key EnumerationSiYuan versions be... — CVE ThreatInt

• WWBN AVideo Broken Access Control via videoViewsInfo hash ParameterWWBN AVide... — CVE ThreatInt

• WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpWWBN AVi... — CVE ThreatInt

• WWBN AVideo Weak PRNG Password Generation via External LoginWWBN AVideo gener... — CVE ThreatInt

• AVideo API Rate Limit Bypass via Bot User-Agent HeaderAVideo API fails to enf... — CVE ThreatInt

• Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification By... — CVE ThreatInt

• Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login RouteL... — CVE ThreatInt

• CDT before 1.4.5 Out-of-Bounds Read via opposedVertexIndCDT before 1.4.5 cont... — CVE ThreatInt

• Nokri – Job Board WordPress Theme through 1.6.4 - Missing Authorization to Authent... — CVE ThreatInt

• Ninja Forms - Save Progress through 3.0.30 - Missing Authorization to Authenticate... — CVE ThreatInt

• Mail Mint through 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form ... — CVE ThreatInt

• LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment vi... — CVE ThreatInt

• I also have a cyber newsletter that goes out every Sunday, just in case reading a hand-curated digest of how absolutely... — @zackwhittaker@mastodon.social

• ICYMI: I wrote some words for my blog about why Americans are destroying Flock cameras, and where the privacy fight... — @zackwhittaker@mastodon.social

• SQL Chat Unauthenticated Arbitrary SQL Execution (CVE-2026-86123) — thehackerwire.com (discovered)

• Each week, Metacurity offers its readers a roundup of the best infosec long reads we couldn't do justice to in the... — @metacurity@infosec.exchange

• Common skill missing from SOC analysts — r/cybersecurity

• How to improve at threat hunting when you find nothing? — r/cybersecurity

• A black box drawn over text in a PDF removes nothing — the words are still extractable — r/cybersecurity

• Actively exploited sandbox RCE in all Chromium versions — r/cybersecurity