27 matches found
GO-2026-6408 SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode in github.com/siyuan-note/siyuan/kernel...
Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.
Summary opentelemetry-go is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-29181. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction...
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72812. Summary The /api/ref/refreshBacklink endpoint is gated by CheckAuth only. Unlike its mutating siblings, it carries no CheckAdminRole, no CheckReadonly, and no inline reader-role guard so it falls through all three authorization mechanisms the...
GHSA-WGWX-479J-23VQ SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72812. Summary The /api/ref/refreshBacklink endpoint is gated by CheckAuth only. Unlike its mutating siblings, it carries no CheckAdminRole, no CheckReadonly, and no inline reader-role guard so it falls through all three authorization mechanisms the...
EUVD-2026-58627
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode...
Duplicate Advisory: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wgwx-479j-23vq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint...
CVE-2026-72812
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...
CVE-2026-72812
SiYuan has a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint for versions before v3.7.4. The issue allows anonymous readers to trigger persistent server-side writes by supplying an attacker-controlled block ID, which can flush transaction queues, scan all references g...
CVE-2026-72812 SiYuan before v3.7.4 Missing Authorization via refreshBacklink
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...
CVE-2026-72812
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...
CVE-2026-72812 SiYuan before v3.7.4 Missing Authorization via refreshBacklink
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...
PT-2026-71982
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A missing authorization issue exists in the '/api/ref/refreshBacklink' endpoint. This allows anonymous readers to trigger persistent server-side writes by invoking the endpoint with a controlled block...
CVE-2026-72812: Missing Authorization
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...
CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
EUVD-2026-58125
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...