WordPress plugin Aruba HiSpeed Cache 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-2668

A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispatch/user/add of the component User Handler. The manipulation results in improper access controls. The attack may be launched remotely. The...

CVE-2026-2669

Rongzhitong Visual Integrated Command and Dispatch Platform is identified as vulnerable in CVE-2026-2669. The affected component is the User Handler, specifically the file path /dm/dispatch/user/delete. The root cause is improper access controls caused by manipulating the argument ID, enabling re...

CVE-2026-2667

Rongzhitong Visual Integrated Command and Dispatch Platform is affected. The vulnerability targets an unknown function in the file /dispatch/api?cmd=userinfo, leading to improper access controls. The issue is exploitable remotely and an exploit has been disclosed publicly. The vendor was contacte...

CVE-2025-70141

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in adminclass.php based on the action parameter. An unauthenticated remote attacke...

Saturn Remote Mouse Server 访问控制错误漏洞

Saturn Remote Mouse Server is a remote mouse server developed by Saturn Remote Corporation. The Saturn Remote Mouse Server has an access control vulnerability, which stems from a command injection vulnerability. This vulnerability allows unverified attackers to execute arbitrary commands by sendi...

Rongzhitong Visual Integrated Command and Dispatch Platform 访问控制错误漏洞

Rongzhitong Visual Integrated Command and Dispatch Platform is an integrated command system for emergency management and public safety developed by Rongzhitong Corporation. The Rongzhitong Visual Integrated Command and Dispatch Platform versions 20260206 and earlier contained a access control...

Rongzhitong Visual Integrated Command and Dispatch Platform 访问控制错误漏洞

Rongzhitong Visual Integrated Command and Dispatch Platform is an integrated command system for emergency management and public safety developed by Rongzhitong Corporation. The Rongzhitong Visual Integrated Command and Dispatch Platform versions 20260206 and earlier contained a access control...

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs

Summary A broken access control vulnerability in Gogs allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI internal/route/repo/issue.go fails to verify that the label being modified belongs to the...

Security Bulletin: File permission modification, improper access control, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to file permission modification, improper access control, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-24049 DESCRIPTION: wheel is a command line tool for manipulating Python wheel files, ...

WordPress plugin Smart Forms 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the admin/login process. An attacker can gain unauthorized access to administrative backend functionality by leveraging insufficient role-based access control checks during authentication. This is only...

WordPress plugin AdForest 访问控制错误漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García using Rust. Versions of Vaultwarden prior to 1.35.3 contained a security vulnerability. This vulnerability stemmed from improper access control for endpoints, ciphers, and organization-details,...

CVE-2025-48514

Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality...

CVE-2025-48514

CVE-2025-48514 concerns insufficient granularity of access control in AMD SEV firmware, enabling a privileged attacker to create a SEV-ES Guest that can attack an SNP guest and potentially lead to a confidentiality loss. The description is consistent across multiple feeds (Red Hat, Debian OSV, NV...

CVE-2026-21238

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-21238

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-24900

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...