CVE-2026-73841

OpenChoreo (Kubernetes platform) is affected by CVE-2026-73841 in versions 1.2.0-rc.1 through 1.2.0. The flaw lies in internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go, which authorize component:exec and wirelogs:view using a caller-supplied project...

CVE-2026-19710

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...

PT-2026-71432

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6mcf-g667-w3qv. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

EUVD-2026-57606

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422

CVE-2026-73422 (Astro) : From 2.9.0 through 7.1.0, Astro’s server-side View Transition CSS generator serializes animation properties into an inline style element without escaping for CSS/HTML contexts. An attacker-controlled value (e.g., duration) can terminate the style element and inject arbitr...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-72806 SiYuan before v3.7.4 Authentication Bypass via Attribute View

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including...

EUVD-2026-57451

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-72791

SiYuan v3.7.4-alpha.1 contains an information-disclosure flaw in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and lacks publish-access filtering, allowing reader-role callers to view the complete database view structure (view names, icons, layout ty...

CVE-2026-47226

CVE-2026-47226 (Admidio) : Prior to v5.0.10, an authenticated user with upload rights on any one folder can permanently delete files from folders where they have only view access. The top-level authorization checks use the attacker-supplied folder_uuid to grant upload-rights, while the file_delet...

Security Bulletin:Vulnerability in jackson-databind affects IBM Netezza Appliance

Summary The jackson-databind package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-54515, CVE-2026-59889 Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

CVE-2026-72791: Missing Authorization

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-4879: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...

CVE-2026-18244: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

CVE-2026-73422: Improper Neutralization of Input During Web Page Generation

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...