Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...

PT-2026-84661

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-73741

A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level...

CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-75594

Kirby , an open-source CMS, is affected by a path traversal vulnerability in its media handler (src/Cms/Media.php, Kirby\Cms\Media::thumb()) and the file::version path (src/Filesystem/Asset.php). On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote unauthenticated...

CVE-2026-75592

Kirby (open-source CMS) contained an incomplete filesystem containment flaw in its media handler prior to 4.9.5 and 5.5.2 . The Dir::realpath() and F::realpath() functions accepted a sibling directory sharing the intended root's string prefix (e.g., /var/www/site2 next to /var/www/site) without e...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82650 SiYuan before v3.8.1 Path Traversal via /api/template/render

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650 SiYuan before v3.8.1 Path Traversal via /api/template/render

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint. The endpoint restricts the supplied path to the workspace directory (util.IsAbsPathInWorkspace) but, unli...

EUVD-2026-68236

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650 SiYuan before v3.8.1 Path Traversal via /api/template/render

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650: Exposure of Resource to Wrong Sphere

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

PT-2026-83577

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description An issue exists in kernel/server/serve.go where the IsForbiddenAbsPath guard is not applied to the '/history/path' and '/repo/diff/path' endpoints. Although these endpoints require administrator...

PT-2026-83576

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

Security Bulletin: Security Vulnerability in Apache Zookeeper affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-24281 CVE-2026-24308)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Zookeeper Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails,...

PT-2026-83085

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description A path traversal issue exists in the asset.upload MCP tool, which allows the use of arbitrary absolute file paths because it lacks workspace boundary validation. Through prompt injection, an attacker...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21640-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21640-1 advisory. Update to version 3.1 bsc1274715. Security issues fixed: - CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser...

CVE-2026-82237: Incomplete Cleanup

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...