CVE-2026-74904

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-74904

In SiYuan before v3.7.4, 17 block endpoints in kernel/api/block.go (getRefText, checkBlockExist, getBlockBreadcrumb) are gated only by model.CheckAuth without publish-access filtering, letting anonymous publish-mode readers disclose private block content, metadata, and existence info. Patch to v3...

CVE-2026-74904 SiYuan before v3.7.4 Missing Authorization via block API

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

EUVD-2026-60585

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-72142

A flaw was found in the i2c-imx driver of the Linux kernel. When an I2C slave device performs an SMBus block-read operation with a byte count of zero, the atomic polling path in the driver fails to properly release the I2C bus. This can cause the bus to become stuck, requiring a power cycle of th...

WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.5...

EUVD-2026-60548

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

Linux Distros Unpatched Vulnerability : CVE-2026-74372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - raid1: fix nrpending leak in REQATOMIC bad-block error path In raid1writerequest, each per-mirror loop iteration begins by incrementing rdev-nrpending. If a...

Linux Distros Unpatched Vulnerability : CVE-2026-72141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

EUVD-2026-60437

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

EUVD-2026-60247

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

JetBrains YouTrack before 2026.2.18068 allows stored XSS via the fenced code-block language label; an unauthenticated attacker can inject JavaScript that executes in other users' browsers, scoring CVSS 8.2 HIGH. Exploitation status is not provided in the documents. Upgrade to YouTrack 2026.2.1806...

The vulnerability of the __req_mod() function in the drivers/block/drbd/drbd_req.c module of the Linux kernel’s block device driver allows a attacker to cause a service failure.

The vulnerability of the reqmod function in the drivers/block/drbd/drbdreq.c file of the Linux kernel’s block device driver involves pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...