CVE-2026-73048 SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-72640

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

EUVD-2026-58286

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

CVE-2026-72640

Summary: The Elastic Cloud on Kubernetes (ECK) operator has a vulnerability where it reads secret references from an annotation on secrets it manages and trusts the listed namespace without validating authorization. This allows a user with permissions limited to their own namespace to trigger a r...

SUSE CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without...

PT-2026-71758

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

“Zoomsday” flaws could let one Zoom participant attack another

Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data. The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process...

CVE-2026-72526

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526

Summary: CVE-2026-72526 concerns the multicloud-integrations component where the Application propagation controller mishandles the ocm-managed-cluster annotation from an Application CR without sufficient validation. This allows a hub-cluster tenant with permission to create Applications to target...

EUVD-2026-57057

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72808: Missing Authorization

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

PT-2026-71250

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/asset/getFileAnnotation' endpoint. The endpoint returns .sya PDF-annotation file content without performing a publish-access check, as it is only...

PT-2026-85352

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7ph-r5r6-4jcj. This link is maintained to preserve external references. Original Description SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the...

PT-2026-70970

Name of the Vulnerable Software and Affected Versions multicloud-integrations affected versions not specified Description A flaw exists in the multicloud-integrations component where the Application propagation controller fails to properly validate the ocm-managed-cluster annotation within an...