GHSA-MP7R-57W4-5QM3 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

CVE-2026-75925

IXON VPN Client versions prior to 1.4.7 contain a CRLF injection vulnerability (CWE-93, with contributing CWE-306) that enables remote code execution with root or SYSTEM privileges . The local configuration service accepts changes without authenticating the requester and writes values to a file l...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

EUVD-2026-57453

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers...

EUVD-2026-57455

SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...

GHSA-H6W7-XXCF-W2MQ SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72795. Summary /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed gate only the requested block against publish access. The blocks pulled in by that block's embed transclusion query are inlined into the returned DOM with no...

EUVD-2026-57454

SiYuan: The session-cookie signing key Conf.CookieKey is returned to anonymous readers by /api/system/getConf...

GHSA-FGMR-7W36-9QFQ SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72796. Summary Several static-file routes in the server mux kernel/server/serve.go are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST...

EUVD-2026-57456

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers...

GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...

EUVD-2026-57457

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers...

CVE-2026-82684 Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...

EUVD-2026-57458

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns...

GHSA-MFRJ-V65R-979C SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE: This vulnerability corresponds to CVE-2026-72798. Summary renderAttributeView correctly applies the reader publish-access filter, but the filter's row-accessibility decision is keyed solely to the row's first cell, and it never inspects the remaining cells' values. Relation and Rollup cells...

GHSA-5W7R-F4CG-RQQ7 SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72799. Summary Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when...

EUVD-2026-57459

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers...

GHSA-F794-5JV7-7672 vulnerabilities

Vulnerabilities for packages: open-webui, nemo...

CVE-2026-12878

A flaw was found in the Codefresh platform. An authenticated user can exploit an API endpoint to elevate their privileges to administrative permissions, potentially gaining full control over the platform...

CVE-2026-79389

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the...

CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...