WordPress Post Duplicator plugin <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter vulnerability

Missing Authorization to Authenticated Contributor+ Protected Post Meta Insertion via 'customMetaData' Parameter vulnerability discovered by Nguyen Ba Hung bashu - KCSC in WordPress Plugin Post Duplicator versions = 3.0.8...

ROS-20260224-73-0012

Vulnerability in php-itop related to a flaw in the authorization mechanism. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20260224-73-0034

Vulnerability in gitea related to a flaw in the authorization mechanism. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20260224-73-0033

Vulnerability in gitea related to lack of protection for proprietary data. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...

FUXA 安全漏洞

FUXA is a web-based process visualization software developed by frangoteam. Versions of FUXA 1.2.8 and earlier contained security vulnerabilities. These vulnerabilities stemmed from an authentication bypass mechanism. The server/api/jwt-helper.js middleware improperly trusted the HTTP Referer...

ROS-20260224-73-0032

A vulnerability in the Gitea Git repository management system is related to access control errors. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...

ROS-20260224-73-0035

Vulnerability in gitea related to a flaw in the authorization mechanism. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

Now Platform IT infrastructure management system Access Control Unauthorized Access

The vulnerability of the Now Platform IT infrastructure management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

GO-2026-4498 Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

CVE-2026-26336

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories like WEB-INF via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files...

CVE-2026-25232

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches including the default branch by sending a direct POST request, completely bypassing th...

Grafana Correlation Function Unauthorized Access

The vulnerability of the correlation function of the Grafana monitoring and observation platform is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

SEV microprogramming software components

The vulnerability of the SEV microprogramming software for AMD graphics processors is related to improper prevention of bit modification of the lock bits. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

AMD RMP SMM Compromise

The vulnerability of RMP and SMM components of AMD’s microprogramming graphics processors is related to improper handling of overlapping protected memory ranges. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

Znuny HttpOnly Session Bypass

The vulnerability of the software for rapid display and access to information about clients in Znuny is related to the absence of the “HttpOnly” flag in session cookie files. Exploiting this vulnerability can allow a hacker to gain unauthorized access to protected information...

AMD graphics processor Privilege Escalation

The vulnerability of AMD’s microprogrammed graphics processor software is related to the improper isolation of common resources between trusted and untrusted agents. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

Gitea Access Control Unauthorized Access

The vulnerability of the Git repository management system Gitea is related to access control errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

syngo.plaza Weak Encryption Unauthorized Access

The vulnerability of the software platform for medical visualization and image processing in syngo.plaza is related to the use of weak encryption algorithms. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and gain unauthorized access to protected...

AMD graphics processor software Data Compromise

The vulnerability of AMD’s microprogrammed graphics software is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of protected information...

CVE-2026-26336

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories like WEB-INF via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files...