PT-2026-102388

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient publish-access checks in the 'getCurrentAttrViewImages' endpoint allow users with publish reader permissions to retrieve image asset paths from unauthorized databases. By providing an...

EUVD-2026-87893

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

PT-2026-99498

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27 Description The plugin fails to verify if a user managing a feed campaign has the necessary permissions to publish content or attribute posts to other accounts. This allows users with...

CVE-2026-89001: Improper Privilege Management

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-100635

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

CVE-2026-100635 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

CVE-2026-100635

Versions of SiYuan prior to v3.8.4 are susceptible to an authentication bypass vulnerability within the publish service . The root cause is that session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. This allows an on-path attacker to intercept a valid p...

CVE-2026-100635 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

EUVD-2026-87729

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

CVE-2026-100635 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

CVE-2026-100635: Cleartext Transmission of Sensitive Information

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

PT-2026-99306

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An authentication bypass exists in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid...

CVE-2026-77193

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2026-77193 eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2026-77193

The eesy_ID2WP – Publish InDesign HTML5 WordPress plugin is vulnerable to Path Traversal in all versions up to and including 1.0.3 . The flaw exists within the id2wp_path query parameter, allowing unauthenticated attackers to perform an arbitrary file read . This can lead to the exposure of sensi...

CVE-2026-77193 eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

EUVD-2026-85815

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

WordPress eesy_ID2WP – Publish InDesign HTML5 plugin <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read vulnerability

Unauthenticated Path Traversal to Arbitrary File Read vulnerability discovered by sermsak in WordPress Plugin eesyID2WP – Publish InDesign HTML5 versions = 1.0.3...

Malicious Package

Overview @test1230504/test-publish-verify is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-77193: Improper Limitation of a Pathname to a Restricted Directory

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...