EUVD-2026-58618

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers...

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

Summary /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so...

PT-2026-122415

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these...

CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CLSA-2024-1719932549 kernel: Fix of 20 CVEs

net: iptunnel: make sure to pull inner header in iptunnelrcv CVE-2024-26882 - net: Set true network header for ECN decapsulation CVE-2024-26882 - media: dvb-core: Fix use-after-free due to race at dvbregisterdevice CVE-2022-45884 - media: dvbdev: fix error logic at dvbregisterdevice...

PT-2026-115423

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-103911: Improper Control of Generation of Code

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131774)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131774 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating a...

CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

EUVD-2026-102190

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610

The photo-management tool Lychee is vulnerable to an improper access control issue in versions prior to 7.6.1 . When photos_star_visibility is set to anonymous, the POST /api/v2/Photo::highlight endpoint fails to verify if a caller has permission to see a photo before processing the request. Spec...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cachefiles: The exposure of the anonymous file descriptor is deferred until after copytouser succeeds. After installing the anonymous file descriptor, we can now see it in userland and close it. However, at this point we may not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs: Export anoninodemakesecureinode and fix secretmem LSM bypass Exporting anoninodemakesecureinode enables KVM guestmemfd to create anonymous inodes with proper security context. This replaces the current practice of calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: check for partial overlaps in anonymous sets The user space provides an optimized representation when case intervals are adjacent, where the end element is omitted. The existing partial overlap detection...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mm/khugepaged: fixed -anonvma race condition If an -anonvma is attached to the VMA, the collapseandfreepmd function requires it to be locked. Page table traversal is allowed under any of the following conditions: the mmap lock...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Anonymous sets are never used with a timeout flag; therefore, this behavior is disallowed. An exception to this rule applies for NFTSETEVAL, to ensure that legacy metering mechanisms continue to work properly...