Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]
Reportedly, the ShinyHunters extortion group breached the leak site of one of its competitors, the Clop ransomware gang. ShinyHunters is a financially motivated cybercrime and extortion group active since 2019. It is known for stealing large volumes of data and pressuring victims to pay, rather than necessarily deploying ransomware. One recent high-profile organization targeted by the group was Instructure, the maker of Canvas LMS. ShinyHunters claimed it stole 3.65 TB of data belonging to…
Grav US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.3, CVEs: CVE-2026-72702, CVE-2026-72701, CVE-2026-72698, CVE-2026-72697, CVE-2026-72696, Summary: CVE-2026-72702 9.3 Grav CMS before 2.0.16 Origin Validation Bypass via Referer CVE-2026-72701 6.3 Grav CMS before 2.0.16 Timing Attack via verifyNonce CVE-2026-72698 7.1 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass CVE-2026-72697 7.1 Grav CMS before 2.0.16 Path Traversal via…
EPSS < 0.01 CVSS 9.3 CVE-2026-72696 CVE-2026-72697 CVE-2026-72698 CVE-2026-72701 CVE-2026-72702 Grav FI