CVE-2026-19828

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19828

CVE-2026-19828 affects 648540858 wvp-GB28181-pro version 2.7.4-20260107, specifically the Snapshot Endpoint’s PlayController.java. The vulnerability arises from manipulation of the deviceId/channelId argument, enabling path traversal. The attack can be remote, with a publicly available exploit (e...

EUVD-2026-58659

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19828 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19827 alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the...

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-72834

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-72812

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

CVE-2026-73630 SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

EUVD-2026-58620

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and reachable anonymously. The endpoint does not return a failure code; its outcome is signalled solely by the response message and th...

EUVD-2026-58654

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72834

CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...

EUVD-2026-58648

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-72831

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...