19692 matches found
CVE-2026-74903
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...
EUVD-2026-60584
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...
CVE-2026-74903 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...
CVE-2026-74903
SiYuan before v3.7.4 has an insufficient access control flaw in the /api/lute/spinBlockDOM endpoint, guarded only by CheckAuth middleware rather than CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke it to transform arbitrary DOM input, a...
CVE-2026-72199
A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to...
CVE-2026-65331
creationtimestamp| type| source ---|---|--- 2026-08-18 04:49:30+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818...
VMware ESX 8.0 / 9.0 / 9.1 Insufficient Logging (VMSA-2026-0006)
The version of VMware ESX installed on the remote host is 8.0 prior to build 25429389 8.0 Update 3j, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25370933 9.1.0.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX contai...
PT-2026-77197
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
PT-2026-77136
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-72119
A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...
CVE-2026-9816
Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...
CVE-2026-15748
creationtimestamp| type| source ---|---|--- 2026-08-17 20:05:36+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mtcisrxz2p2u 2026-08-17 22:00:44+00:00| seen| https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html 2026-08-18 01:00:32+00:00| seen|...
CVE-2026-71203
creationtimestamp| type| source ---|---|--- 2026-08-17 18:00:04+00:00| seen| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA 2026-08-18 00:00:12+00:00| published-proof-of-concept| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA...
CVE-2026-72303
A flaw was found in the ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULENOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed...
CVE-2026-70412
creationtimestamp| type| source ---|---|--- 2026-08-17 13:47:19+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtbtoejirt2o 2026-08-17 14:06:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jyn2go5y64m3t...
UBUNTU-CVE-2026-75006
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...
CVE-2026-14564 Sensitive Data Exposure in Innotim Software's Logsign SIEM
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...
EUVD-2026-60161
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...
CVE-2026-74895
creationtimestamp| type| source ---|---|--- 2026-08-17 12:10:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtboauu7st2b 2026-08-17 12:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5wvod3x3ygyvu 2026-08-17 19:10:04+00:00| seen|...