SUSE CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

UBUNTU-CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

EUVD-2026-64532

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-76603

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

EUVD-2026-64322

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-77992

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are affected by a heredoc terminator breakout in the calc element . The root cause is that the onUpdateComment endpoint did not perform any access checks, allowing unauthenticated network-based attacks with low complexity and no ...

CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

EUVD-2026-64319

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.3 - ???...

CVE-2026-76609

Fabrik is a Joomla extension that provides form and data management capabilities. In versions prior to 4.7.2 , the onUpdateComment endpoint lacked any access control checks, allowing an unauthenticated attacker over the network to modify any comment. The CVSS 4.0 base score is 6.9 (MEDIUM) , refl...

EUVD-2026-64318

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76601 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-60083

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-60083

SiYuan versions before v3.8.0 have an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files normally protected by the HTTP API. An authenticated administrator can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and acc...