Forged signed tokens enable account takeover in GitroomHQ postiz-app

🕵️ RESEARCH & DEEP DIVES

• Autonomous root exploit chain released for TCL 50C721 Android TV via CVE-2022-22706 Mali GPU flaw CVE-2022-22706
  A researcher released a full source autonomous root chain for the TCL 50C721 Android TV exploiting CVE-2022-22706, an Arm Mali GPU kernel driver page-cache write vulnerability.
  • Applies to TCL 50C721 Android TV (RTD1319 SoC with Mali-G31 GPU); CVE-2022-22706 affects Arm Mali GPU kernel driver Midgard r26p0 through later releases.
  • CVE-2022-22706 lets a non-privileged user gain write access to read-only memory pages via the Mali GPU kernel driver.
  • The released toolkit (mali-pagecache-root on GitLab, MIT licensed) is an autonomous exploit chain that roots the TV using the Mali page-cache write primitive.
  • The exploit source was published on r/netsec by researcher u/amnioticboy.
  Sources 📄 Source: gitlab.com · 📎 Coverage: reddit.com · 👁 via r/netsec

🔓 CVEs & KEV

• CVE-2026-115933 — GitroomHQ postiz-app — CVSS 9.9 — Forged signed tokens let any registered user take over other users and organi...

• CVE-2026-115932 — GitroomHQ postiz-app — CVSS 9.6 — Path traversal in post media lets any registered user read server filesWhen a...

• CVE-2026-115557 — Python Software Foundation CPython — CVSS 9.4 — Distrust compromised intermediate certificates in ssl modulePython has added ...

• CVE-2026-94267 — WPScan Advanced Custom Fields: Extended — CVSS 9.0 — Advanced Custom Fields: Extended before 0.9.2.8 - Unauthenticated RCE via Front-En...

• CVE-2026-116019 — getgrav grav — CVSS 8.7 — Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override DirectivesG...

• CVE-2026-116009 — owen2345 camaleon-cms — CVSS 8.7 — Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url ActionCamaleo...

• CVE-2026-94268 — WPScan Advanced Custom Fields: Extended — CVSS 8.1 — Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Acco...

• CVE-2026-94262 — WPScan Advanced Custom Fields: Extended — CVSS 8.1 — Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator ...

• CVE-2026-113500 — WPScan LiteSpeed Cache — CVSS 7.5 — LiteSpeed Cache before 7.9.2 - Unauthenticated Stored XSS via Font Display Optimiz...

• CVE-2026-113499 — WPScan LiteSpeed Cache — CVSS 7.5 — LiteSpeed Cache before 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewri...

• CVE-2026-109936 — WPScan Otter Blocks — CVSS 7.5 — Otter Blocks before 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render ...

• CVE-2026-94264 — WPScan Advanced Custom Fields: Extended — CVSS 6.8 — Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via For...

• CVE-2026-109933 — WPScan Otter Blocks — CVSS 6.8 — Otter Blocks before 3.2.8 - Contributor+ Stored XSS via Block Style AttributesThe ...