139171 matches found
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
EUVD-2026-71005
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler . Authenticated attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite proce...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85579 SiYuan before v3.8.2 Information Disclosure via undoState
SiYuan is affected by an information disclosure vulnerability confirmed in v3.8.1, fixed in v3.8.2 in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying...
baluni (>=1.0.0, <=2.7.2), fast-publish (>=0.0.1-alpha.0, <=0.0.2) potentially affected by unknown CVE via chakl (0.0.1-security)
chakl NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on chakl and may be impacted: - baluni =1.0.0, =0.0.1-alpha.0, =0.0.2 Source cves: unknown CVE Source advisory: GHSA-CQRX-V4P2-4JH6...
CVE-2026-79391
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-79391: Missing Authentication for Critical Function
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-85584: Allocation of Resources Without Limits or Throttling
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
PT-2026-85484
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...
PT-2026-85482
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-85582: Allocation of Resources Without Limits or Throttling
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...
CVE-2026-79391
The Trueview 6.0.23.4 software is affected by a critical security vulnerability where the MQTT service lacks authentication. The MQTT broker accepts client connections on TCP port 1883 without requiring any credentials. This flaw allows a remote attacker with network access to establish an MQTT s...
PT-2026-86252
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
CVE-2026-79391
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...
GHSA-5FHR-F75J-8WR9 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...