CVE-2026-80255: Insertion of Sensitive Information Into Sent Data

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

Exploit for Classic Buffer Overflow in Apple Macos

CVE-2026-64705 — HFS xattr kernel heap overflow macOS Root-...

OESA-2026-3630 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3631 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3629 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3628 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

CVE-2026-86191

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86192

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86192

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeys endpoint. The root cause is a failure to properly filter private attribute-view cell values, allowing publish readers to retrieve hidden KeyValues payloads from rows bound to inaccessible doc...

EUVD-2026-72012

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86191

SiYuan versions before v3.8.2 are affected by an information disclosure vulnerability in the getAttributeViewKeysByID endpoint. The root cause is that publish readers can enumerate private attribute view key definitions without the system verifying parent database visibility, allowing attackers t...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-76573

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573

The Pods – Custom Content Types and Fields WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the 'not_found' shortcode attribute in all versions up to and including 3.3.9.1 . The root cause is insufficient input sanitization and output escaping . Authenticated attackers with...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...