[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-72830":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-14T16:36:57.460Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":264,"aliases":265,"duplicate_of":9,"upstream":266,"downstream":267,"duplicates":268,"related":269,"reserved_at":9,"published_at":270,"modified_at":270,"state":271,"summary":272,"references_raw":279,"kevs":291,"epss":9,"epss_history":292,"metrics":293,"affected":305},"CVE-2026-72830","Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-269","Improper Privilege Management","The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","weakness","Draft","Class","Medium",[20,182,260],{"id":21,"name":22,"techniques":23},"CAPEC-122","Privilege Abuse",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1548","Abuse Elevation Control Mechanism",[28,31],{"id":29,"name":30},"TA0030","Defense Evasion",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,50,55,59,63,67,72,76,80,84,88,92,96,100,104,109,113,117,121,126,130,134,138,142,146,150,154,158,162,166,170,174,178],{"id":36,"name":37,"tactic":38},"D3-CM","Content Modification",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-AEM","Application Exception Monitoring",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-DF","Decoy File",{"name":49},"Deceive",{"id":51,"name":52,"tactic":53},"D3-CI","Configuration Inventory",{"name":54},"Model",{"id":56,"name":57,"tactic":58},"D3-SCA","System Call Analysis",{"name":44},{"id":60,"name":61,"tactic":62},"D3-SFA","System File Analysis",{"name":44},{"id":64,"name":65,"tactic":66},"D3-FA","File Analysis",{"name":44},{"id":68,"name":69,"tactic":70},"D3-FE","File Encryption",{"name":71},"Harden",{"id":73,"name":74,"tactic":75},"D3-AA","Agent Authentication",{"name":71},{"id":77,"name":78,"tactic":79},"D3-CDP","Change Default Password",{"name":71},{"id":81,"name":82,"tactic":83},"D3-AM","Access Modeling",{"name":54},{"id":85,"name":86,"tactic":87},"D3-DI","Data Inventory",{"name":54},{"id":89,"name":90,"tactic":91},"D3-NTPM","Network Traffic Policy Mapping",{"name":54},{"id":93,"name":94,"tactic":95},"D3-PSA","Process Spawn Analysis",{"name":44},{"id":97,"name":98,"tactic":99},"D3-SCP","System Configuration Permissions",{"name":71},{"id":101,"name":102,"tactic":103},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":105,"name":106,"tactic":107},"D3-RC","Restore Configuration",{"name":108},"Restore",{"id":110,"name":111,"tactic":112},"D3-RF","Restore File",{"name":108},{"id":114,"name":115,"tactic":116},"D3-ULA","Unlock Account",{"name":108},{"id":118,"name":119,"tactic":120},"D3-RUAA","Restore User Account Access",{"name":108},{"id":122,"name":123,"tactic":124},"D3-FEV","File Eviction",{"name":125},"Evict",{"id":127,"name":128,"tactic":129},"D3-RD","Restore Database",{"name":108},{"id":131,"name":132,"tactic":133},"D3-AL","Account Locking",{"name":125},{"id":135,"name":136,"tactic":137},"D3-OPM","Operational Process Monitoring",{"name":44},{"id":139,"name":140,"tactic":141},"D3-DA","Dynamic Analysis",{"name":44},{"id":143,"name":144,"tactic":145},"D3-EFA","Emulated File Analysis",{"name":44},{"id":147,"name":148,"tactic":149},"D3-SCF","System Call Filtering",{"name":39},{"id":151,"name":152,"tactic":153},"D3-CF","Content Filtering",{"name":39},{"id":155,"name":156,"tactic":157},"D3-LFP","Local File Permissions",{"name":39},{"id":159,"name":160,"tactic":161},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":163,"name":164,"tactic":165},"D3-CQ","Content Quarantine",{"name":39},{"id":167,"name":168,"tactic":169},"D3-UAP","User Account Permissions",{"name":39},{"id":171,"name":172,"tactic":173},"D3-HBPI","Hardware-based Process Isolation",{"name":39},{"id":175,"name":176,"tactic":177},"D3-EAL","Executable Allowlisting",{"name":39},{"id":179,"name":180,"tactic":181},"D3-EDL","Executable Denylisting",{"name":39},{"id":183,"name":33,"techniques":184},"CAPEC-233",[185],{"id":25,"name":26,"tactics":186,"countermeasures":189},[187,188],{"id":29,"name":30},{"id":32,"name":33},[190,192,194,196,198,200,202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,238,240,242,244,246,248,250,252,254,256,258],{"id":36,"name":37,"tactic":191},{"name":39},{"id":41,"name":42,"tactic":193},{"name":44},{"id":46,"name":47,"tactic":195},{"name":49},{"id":51,"name":52,"tactic":197},{"name":54},{"id":56,"name":57,"tactic":199},{"name":44},{"id":60,"name":61,"tactic":201},{"name":44},{"id":64,"name":65,"tactic":203},{"name":44},{"id":68,"name":69,"tactic":205},{"name":71},{"id":73,"name":74,"tactic":207},{"name":71},{"id":77,"name":78,"tactic":209},{"name":71},{"id":81,"name":82,"tactic":211},{"name":54},{"id":85,"name":86,"tactic":213},{"name":54},{"id":89,"name":90,"tactic":215},{"name":54},{"id":93,"name":94,"tactic":217},{"name":44},{"id":97,"name":98,"tactic":219},{"name":71},{"id":101,"name":102,"tactic":221},{"name":44},{"id":105,"name":106,"tactic":223},{"name":108},{"id":110,"name":111,"tactic":225},{"name":108},{"id":114,"name":115,"tactic":227},{"name":108},{"id":118,"name":119,"tactic":229},{"name":108},{"id":122,"name":123,"tactic":231},{"name":125},{"id":127,"name":128,"tactic":233},{"name":108},{"id":131,"name":132,"tactic":235},{"name":125},{"id":135,"name":136,"tactic":237},{"name":44},{"id":139,"name":140,"tactic":239},{"name":44},{"id":143,"name":144,"tactic":241},{"name":44},{"id":147,"name":148,"tactic":243},{"name":39},{"id":151,"name":152,"tactic":245},{"name":39},{"id":155,"name":156,"tactic":247},{"name":39},{"id":159,"name":160,"tactic":249},{"name":39},{"id":163,"name":164,"tactic":251},{"name":39},{"id":167,"name":168,"tactic":253},{"name":39},{"id":171,"name":172,"tactic":255},{"name":39},{"id":175,"name":176,"tactic":257},{"name":39},{"id":179,"name":180,"tactic":259},{"name":39},{"id":261,"name":262,"techniques":263},"CAPEC-58","Restful Privilege Elevation",[],[],[],[],[],[],[],"2026-08-14T11:35:37.166Z","Received",{"cisa_kev":273,"cisa_ransomware":273,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":274,"severity_score":275,"severity_version":276,"severity_source":277,"severity_vector":278,"severity_status":271},false,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[280,286],{"url":281,"sources":282,"tags":284},"https://github.com/getgrav/grav/security/advisories/GHSA-2x29-3mjq-2pvx",[277,283],"nvd",[285],"Vendor Advisory",{"url":287,"sources":288,"tags":289},"https://www.vulncheck.com/advisories/grav-api-plugin-before-rce-via-configcontroller-scope-bypass",[277,283],[290],"Third Party Advisory",[],[],[294,301],{"source":277,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":295,"cvss_v4_0":298},{"baseScore":275,"baseSeverity":296,"vectorString":278,"impactScore":275,"exploitabilityScore":297},"CRITICAL",10,{"baseScore":299,"baseSeverity":296,"vectorString":300,"impactScore":9,"exploitabilityScore":9},9.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",{"source":283,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":302,"cvss_v4_0":303},{"baseScore":275,"baseSeverity":296,"vectorString":278,"impactScore":275,"exploitabilityScore":297},{"baseScore":299,"baseSeverity":296,"vectorString":304,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[306],{"ecosystem":9,"name":307,"vendor":308,"product":307,"cpe_part":309,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":310},"grav","getgrav","a",[311],{"version":312,"is_range":313,"range_type":277,"version_start":9,"version_start_type":9,"version_end":314,"version_end_type":315,"fixed_in":9},"\u003C 1.0.13",true,"1.0.13","excluding"]