GHSA-9G87-32V6-3C2R Payload: Sort queries could expose protected field information

Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read. You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields. Patches Payload now applies field-level...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2026_27812)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627812 advisory. kernel: selinux: fix overlayfs mmap and mprotect access checks CVE-2026-46054 Tenable has extracted the preceding description block directly from the CIQ security...

CVE-2026-101092

SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...

PT-2026-102388

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient publish-access checks in the 'getCurrentAttrViewImages' endpoint allow users with publish reader permissions to retrieve image asset paths from unauthorized databases. By providing an...

SUSE CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions 8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, and 8.4. before 8.4.10, some functions like fsockopen lack validation to ensure that the supplied hostname does not contain null characters. This may cause other functions like parseurl to handle the hostname differently,...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

PT-2026-82300

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

EUVD-2026-64328

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

EUVD-2026-64321

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

EUVD-2026-64315

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76601

Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...

CVE-2026-76601 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

PT-2026-79584

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onGetEmail' endpoint does not perform necessary access checks, allowing an unauthenticated user to disclose the email address of any commenter. Recommendations Update to...

PT-2026-85349

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-47663 Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

DRUPAL-CONTRIB-2026-093

This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...