CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

EUVD-2026-71007

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584

SiYuan versions before v3.8.2 are affected by a denial of service vulnerability in the publish-service Basic Auth throttle . The throttle stores failed-attempt state keyed by attacker-controlled usernames without enforcing capacity limits or eviction policies, allowing unauthenticated attackers t...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

EUVD-2026-71005

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler . Authenticated attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite proce...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

hostap:eapol-key-auth: Crash in eapol-key-auth.c

Project: git://w1.fi/srv/git/hostap.git Detailed Report: https://oss-fuzz.com/testcase?key=4938556997697536 Project: hostap Fuzzing Engine: libFuzzer Fuzz Target: eapol-key-auth Job Type: libfuzzerubsanhostap Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5c31428362c0 Crash State:...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...

ConnectWise ScreenConnect Auth Bypass RCE (CVE-2024-1709)

Exploits CVE-2024-1709 to recreate the setup wizard and register an administrator, then CVE-2024-1708 path traversal in extension install to drop a .ashx handler that runs a reverse CMD payload. ScreenConnect = 23.9.7. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect auth...

Fortra GoAnywhere MFT Auth Bypass RCE (CVE-2024-0204)

Exploits CVE-2024-0204 to create an administrator via the InitialAccountSetup wizard path traversal, upload a JSP payload through the FileManager, and execute a reverse CMD command. GoAnywhere MFT 6.0.1 through 7.4.0. !/usr/bin/env python3 -- coding: utf-8 -- """Fortra GoAnywhere MFT auth bypass ...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

Linux Distros Unpatched Vulnerability : CVE-2026-80791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE...

Linux Distros Unpatched Vulnerability : CVE-2026-18329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an...