CVE-2026-72812

SiYuan has a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint for versions before v3.7.4. The issue allows anonymous readers to trigger persistent server-side writes by supplying an attacker-controlled block ID, which can flush transaction queues, scan all references g...

CVE-2026-72812 SiYuan before v3.7.4 Missing Authorization via refreshBacklink

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

CVE-2026-72812

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

EUVD-2026-58627

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

CVE-2026-59763

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

EUVD-2026-58125

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763

CVE-2026-59763 affects Gitea’s package upload flow, where unbounded Arch package file metadata can cause resource amplification (availability impact). The issue is tied to Arch metadata handling in the package upload pipeline, leading to potential denial of service through resource exhaustion. Pu...

UBUNTU-CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

GO-2026-6049 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev...

PT-2026-47612

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final Description In the network application framework, DefaultHttp2Connection.DefaultEndpoint initializes maxActiveStreams and maxStreams to Integer.MAX VALUE, while...

CoreDNS DoH GET path missing size validation causes CPU and memory amplification

...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Cloudkit are now included (CVE-2025-30204)

Summary The following vulnerabilities that can affect IBM Storage Scale and the Cloudkit and could provide weaker than expected security are now fixed CVE-2025-30204. Vulnerability Details CVEID:CVE-2025-30204 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Starting in version...

Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings

Impact All versions of Pterodactyl Wings preior to 1.4.4 are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually...