CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

GO-2026-6244 New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api

New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

WordPress Backup Migration plugin < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability

Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability discovered by Thanh Lam Tang in WordPress Plugin Backup Migration versions 2.1.7...

CVE-2026-19670: Incorrect Authorization

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

Duplicati 2.2.0.3 - JWT Signing Key Leak

Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak Bypass leading to Token Forgery Date: 2026-06-23 Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI Vendor Homepage: https://www.duplicati.com Software Link: https://github.com/duplicati/duplicati Version: = 2.2.0.3 commit 6ad921166 and...

CVE-2026-15602

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-59851

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-59798

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

PT-2026-73143

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...

CVE-2026-73046

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-73046

Technical details for CVE-2026-73046 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3mp7-4rh5-jrv9. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth...

GHSA-8WX9-J7J5-H9VP Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3mp7-4rh5-jrv9. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth...

CVE-2026-12618 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input...

CVE-2026-68752

A Project Resource Manager may gain broader administrative privileges under specific conditions...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

EUVD-2026-57231

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...