CVE-2026-81644

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-81644

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-81644

CVE-2026-81644 is a Denial of Service vulnerability in the preview service module , with impact limited to availability . The CVSS 3.1 score is 4.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, indicating a network-reachable, low-complexity attack that requires user interaction and no...

EUVD-2026-74599

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-81644

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-71802: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-87814: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-81644: Undefined Security Weakness

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-88801

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-88947

Name of the Vulnerable Software and Affected Versions Siyuan versions prior to 3.8.2 Description Insufficient publish-access filtering for embedded blocks occurs during rendering. Users with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by...

PT-2026-88952

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description A stored cross-site scripting issue exists in the search asset preview feature. The application fails to escape indexed asset content before inserting it into the Document Object Model DOM using the...

PT-2026-89032

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component AppLivewireImporter, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-71802

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

PT-2026-89172

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.11 through 0.11.0 Description An issue exists where the in-app port preview renders content in an iframe sandbox that simultaneously grants allow-scripts and allow-same-origin. Because the terminal proxy serves this...

PT-2026-89151

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-71802

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

EUVD-2026-75161

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-87809: Authorization Bypass Through User-Controlled Key

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...

CVE-2026-71802

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3 . While the server performs HTML escaping on announcement content, the client-side preview code uses jQuery's html().text() method to reverse those escapes before injecting the result i...

CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...