3167 matches found
SUSE CVE-2026-73627
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
EUVD-2026-58067
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...
CVE-2026-73559 vLLM: Completion prompt lists fan out into unbounded engine requests
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-73607
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
CVE-2026-73608
SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...
CVE-2026-73604
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73627 JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
EUVD-2026-57812
SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...
CVE-2026-73607 SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
CVE-2026-73607
SiYuan: Information disclosure vulnerability in /api/storage/getOutlineStorage on versions before v3.7.4 allows retrieving outline state (including heading IDs) for any document without authorization. This affects confidentiality; upgrade to v3.7.4+ (the fix) or apply vendor advisories. Per sourc...
CVE-2026-73607 SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...
CVE-2026-73606
SiYuan before version 3.7.4 is vulnerable to information disclosure via the /api/block/getRefIDs endpoint. The issue arises because password-protected document tiers are not checked, allowing unauthenticated readers to discover that certain documents reference specific blocks and to obtain block ...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73604
Flowise (pre-3.1.3) has an incomplete credential redaction vulnerability in GET /api/v1/credentials/:id that exposes decrypted secrets to authenticated users with credentials:view. Impact described includes database connection URLs with passwords, cloud service account JSON with private keys, and...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
PT-2026-71435
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists where the '/api/storage/getOutlineStorage' endpoint fails to perform authorization checks. This allows an attacker to retrieve the outline state, including headi...
PT-2026-71434
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/block/getRefIDs' endpoint due to a failure to verify password-protected document tiers. This allows unauthenticated readers to identify that...
PT-2026-71432
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...