CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 is affected by a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health. These endpoints enforce only authentication but omit permission checks, allowing any authenticated user—regardless of privilege level—to read site-w...

EUVD-2026-71012

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March...

CVE-2026-81270

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-81270 Apache Allura: Information exposure via search

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

EUVD-2026-70924

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-81270

Apache Allura versions through 1.20.0 are vulnerable to the exposure of non-public information via the search functionality. This vulnerability allows an unauthorized actor to access sensitive information. To remediate this issue, users are recommended to upgrade to version 1.21.0 .

CVE-2026-81270 Apache Allura: Information exposure via search

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-85397

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

EUVD-2026-70859

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

CVE-2026-85397

A SQL injection vulnerability exists in code-projects Hospital Information System 1.0 , specifically in the findBySearch function within addReq.php . An unauthenticated remote attacker can manipulate the Search argument to inject arbitrary SQL, leading to low-impact compromise of confidentiality,...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

PT-2026-85430

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-81270: Exposure of Sensitive Information to an Unauthorized Actor

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-85589: Missing Authorization

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...