hpfeeds

hpfeeds À propos hpfeeds est un protocole léger de publication-abonnement authentifié. Il possède un format de fil simple afin que chacun puisse s'abonner aux flux avec son langage favori en un rien de temps. Les différents flux sont séparés par des canaux et supportent des charges utiles binaire...

SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. id:...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-68004

CVE-2026-68004: Неаутентифицированная публикация RTMP в SRS Обзор Этот репозиторий содержит технический отчёт и proof-of-concept для CVE-2026-68004 — проблемы неаутентифицированной публикации RTMP в развёртываниях OSSRS / SRS, где vhost.security отключён и не настроена другая аутентификация...

CVE-2026-8054

1. Aperçu de la vulnérabilité CVE-2026-8054 est une vulnérabilité d'injection SQL SQL Injection à haut risque, sans authentification, accessible publiquement Pre-auth SQL Injection présente dans l'API Publish Audit de dotCMS Core. Elle est officiellement suivie comme incident de sécurité SI-75 et...

CVE-2018-11686

CVE-2018-11686 CVE-2018-11686 - FlexPaper PHP Publish Service RCE = 2.3.6 обнаружено Red Timmy Security Технический анализ: https://www.exploit-db.com/docs/english/46521-flexpaper-=-2.3.6-remote-code-execution-whitepaper.pdf Рекомендации по безопасности: неизвестно Доказательство концепции: 1...

heisenberg-ssc-gha

فحص صحة التبعيات هايزنبرغ إجراء GitHub درع خفيف لطلبات السحب PR لتحديثات التبعيات. يقوم بمسح التبعيات الجديدة أو المعدلة فقط من ملف القفل/البيان الخاص بك، ويحصل على إشارات الصحة والمخاطر deps.dev + الاستدلالات، ويشير إلى الإصدارات الحديثة، ويعلق تقريرًا على طلب السحب، ويوسمها اختياريًا للمراجعة...

CVE-2026-77003

The Content Mask WordPress plugin (versions 1.8.0 through 1.8.5.4 ) contains a privilege escalation vulnerability in the create_new_content_mask function. The plugin fails to verify the required capability before publishing the post type being created, allowing users with the Contributor role to ...

CVE-2026-60083

SiYuan versions before v3.8.0 have an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files normally protected by the HTTP API. An authenticated administrator can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and acc...

CVE-2026-74906

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

CVE-2026-74906 SiYuan before v3.7.4 Incorrect Authorization via Publish Access

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

EUVD-2026-60587

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

CVE-2026-74906

SiYuan before v3.7.4 incorrectly filters eight publish-mode endpoints (search, backlink, asset content, saved criteria, recent documents, graph, tag) using the visibility list instead of the disabled list, allowing anonymous users to read documents explicitly marked as forbidden from publishing. ...

CVE-2026-74904

In SiYuan before v3.7.4, 17 block endpoints in kernel/api/block.go (getRefText, checkBlockExist, getBlockBreadcrumb) are gated only by model.CheckAuth without publish-access filtering, letting anonymous publish-mode readers disclose private block content, metadata, and existence info. Patch to v3...

CVE-2026-68004

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

CVE-2026-74868

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation PublishServiceTransport.RoundTrip in kernel/server/proxy/publish.go. The Publish Service runs on a separate, unauthenticated-by-default listener default TCP port 6808 and...

EUVD-2026-60087

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation PublishServiceTransport.RoundTrip in kernel/server/proxy/publish.go. The Publish Service runs on a separate, unauthenticated-by-default listener default TCP port 6808 and...

CVE-2026-74868 SiYuan before 3.7.4 Brute-Force Authentication via Publish Service

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation PublishServiceTransport.RoundTrip in kernel/server/proxy/publish.go. The Publish Service runs on a separate, unauthenticated-by-default listener default TCP port 6808 and...

CVE-2026-74868

SiYuan before 3.7.4 has an unthrottled brute-force flaw in PublishServiceTransport.RoundTrip() (kernel/server/proxy/publish.go), where the Publish Service (default TCP 6808) applies Basic Auth with no rate limiting, lockout, or backoff, letting unauthenticated remote attackers guess passwords aga...

EUVD-2026-60448

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...