139159 matches found
GHSA-5W7R-F4CG-RQQ7 SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72799. Summary Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when...
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72799. Summary Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when...
CVE-2026-79391
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-85584
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
EUVD-2026-71007
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
EUVD-2026-71005
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler . Authenticated attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite proce...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85579 SiYuan before v3.8.2 Information Disclosure via undoState
SiYuan is affected by an information disclosure vulnerability confirmed in v3.8.1, fixed in v3.8.2 in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying...
baluni (>=1.0.0, <=2.7.2), fast-publish (>=0.0.1-alpha.0, <=0.0.2) potentially affected by unknown CVE via chakl (0.0.1-security)
chakl NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on chakl and may be impacted: - baluni =1.0.0, =0.0.1-alpha.0, =0.0.2 Source cves: unknown CVE Source advisory: GHSA-CQRX-V4P2-4JH6...
CVE-2026-79391
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-79391: Missing Authentication for Critical Function
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-85584: Allocation of Resources Without Limits or Throttling
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
PT-2026-85484
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...