HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-65767 — Improper neutralization of input during web page generation ('cross-site scripti...

·Source: NIST NVD

Updated:

Executive Summary

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.

Analysis

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network. CVSS Score: 8.8. Published: 2026-08-11T17:18:55.997.

Indicators of Compromise (1)

CVE (1)
CVE-2026-65767
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-72830 — Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in Con...

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.

CVE-2026-72830
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-72829 — The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key ...

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on

CVE-2026-72829
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-72826 — The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scop...

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super

CVE-2026-72826
NIST NVD