Exploit for CVE-2026-66012

CVE-2026-66012 — SiYuan MCP Unauthenticated Administrator Take...

SUSE CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

EUVD-2026-49043

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012

SiYuan before v3.7.2 has an unauthenticated access path via POST /mcp due to missing authorization enforcement (no admin/read-only role checks). In Publish anonymous mode, an anonymous RoleReader JWT can reach /mcp, enabling an attacker to read conf/conf.json (exfiltrating accessAuthCode, api.tok...

CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

UBUNTU-CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

EUVD-2026-48840

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496 iio: event: Fix event FIFO reset race

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496

The CVE-2026-64496 issue affects the Linux kernel IIO event (iio: event) where a race between kfifo_to_user and kfifo_reset_out could lead to an out-of-bounds read and leakage of kernel memory to userspace. Root cause: iio_event_getfd() uses anon_inode_getfd() to allocate and install a new FD, th...

Linux Distros Unpatched Vulnerability : CVE-2026-21723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing...

Linux Distros Unpatched Vulnerability : CVE-2026-64496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file...

PT-2026-64762

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A missing authorization issue exists in the 'POST /mcp' kernel endpoint, which is only protected by a general authentication check model.CheckAuth without enforcing admin roles or read-only...

PT-2026-64717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Industrial I/O IIO event handling. The function iio event getfd uses anon inode getfd to create an event file descriptor, which is installed in the process...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

SUSE CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723 CVE-2026-21723 Record

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...