CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to vulnerability in Marked

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to vulnerability in Marked. CVE-2026-41680 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-41680 DESCRIPTION: Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of...

Embedded Malicious Code

Overview fetch-page-assets is an A versatile Node.js module for extracting assets such as CSS files, JavaScript files, fonts, and images from HTML content or URLs. Affected versions of this package are vulnerable to Embedded Malicious Code. This release contains a multi-stage, blockchain-C2 remot...

Malicious code in fetch-page-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20a04be5fca12f18a1dc5791b41fb0e1b9feac721b8d12747f32b00a18cb67c babel.config.cjs contains a heavily obfuscated obfuscator.io-style IIFE appended after a legitimate @babel/preset-env block. It queries multiple...

MAL-2026-6358 Malicious code in fetch-page-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20a04be5fca12f18a1dc5791b41fb0e1b9feac721b8d12747f32b00a18cb67c babel.config.cjs contains a heavily obfuscated obfuscator.io-style IIFE appended after a legitimate @babel/preset-env block. It queries multiple...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in follow-redirects

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in follow-redirects. CVE-2026-40895 The vulnerabilities have been addressed Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in...

PT-2026-51642

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description Snipe-IT is an IT asset and license management system. A flaw exists where the update function within app/Http/Controllers/Assets/BulkAssetsController.php accepts the company id variable directly fr...

PT-2026-51461

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.9 Description An issue exists where a workspace-level builder can read any file the server process has access to by uploading a specially crafted PWA zip file. The POST /api/pwa/process-zip endpoint extracts the...

Duplicate Advisory: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c43v-4cr8-6mvp. This link is maintained to preserve external references. Original Description Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the...

GHSA-JCMP-JXH2-4JC3 Duplicate Advisory: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c43v-4cr8-6mvp. This link is maintained to preserve external references. Original Description Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the...

Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x76w-8c62-48mg. This link is maintained to preserve external references. Original Description Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user...

GHSA-XJ2C-G5XP-4P47 Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x76w-8c62-48mg. This link is maintained to preserve external references. Original Description Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user...

GHSA-F4H3-QHG5-J6MQ Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-44px-qjjc-xrhq. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1, = 4.0.0-RC1, = 4.17.7 contain an authorization bypass in the assets/preview-file...

Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-44px-qjjc-xrhq. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1, = 4.0.0-RC1, = 4.17.7 contain an authorization bypass in the assets/preview-file...

CVE-2026-56394

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files,...

CVE-2026-56384

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...

CVE-2026-56385

Craft CMS versions = 5.0.0-RC1, = 4.0.0-RC1, = 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an...

CVE-2026-56394 Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files,...

CVE-2026-56394

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files,...