Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references. Original Description SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7...

CVE-2026-73621 GitPython before 3.1.56 Arbitrary File Truncation via Commit.count

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

CVE-2026-15217

creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...

CVE-2026-11970

This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758...

JLSEC-2026-1280

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

JLSEC-2026-1278 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to...

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soupheaderparseparamliststrict. There is a plausible way to reach this remotely via soupmessageheadersgetcontenttype e.g., an application may want to retrieve the content type of a request or...

WordPress tourmaster plugin < 5.4.8 - Stored XSS vulnerability

Stored XSS vulnerability discovered by ? in WordPress Plugin Tourmaster versions 5.4.8...

RLSA-2026:54272 Important: abrt security update

The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality. Security Fixes: abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump...

abrt security update

An update is available for abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Automatic Bug Reporting Tool ABRT recognizes defects in applications and...

CVE-2026-56864: Improper Verification of Cryptographic Signature

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-57886: Authorization Bypass Through User-Controlled Key

Cross-repository issue/comment attachment re-linking can expose private attachment content...

PT-2026-71522

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-28173: Missing Authorization

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-73608: Missing Authorization

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

RockyLinux 8 : abrt (RLSA-2026:54272)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54272 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds durin...

PT-2026-71557

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

RHEL 9 : yelp (RHSA-2026:54637)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54637 advisory. Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, includin...

RHEL 8 : yelp (RHSA-2026:54605)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54605 advisory. Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, includin...

PT-2026-71900

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client,...