SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. id:...

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

PYSEC-2026-4300 Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

BIT-GHOST-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

EUVD-2026-95986

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

BIT-GHOST-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2026-108258: Improper Limitation of a Pathname to a Restricted Directory

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

PT-2026-109313

Name of the Vulnerable Software and Affected Versions Shiny for Python versions 1.4.0 through 1.6.3 Description The bookmark restore process accepts a client-supplied state id query-string value and joins it into the server-side bookmark directory without proper validation. An unauthenticated...

Ghost: Remote Code Execution via Bookmark Card Images

Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. Vulnerable versions This...

NPM: Ghost: Remote Code Execution via Bookmark Card Images

NPM: Ghost: Remote Code Execution via Bookmark Card Images vulnerability discovered by ? in WordPress Npm ghost versions = 6.56.0, 6.67.0...

GHSA-788W-68H3-CVXP Ghost: Remote Code Execution via Bookmark Card Images

Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. Vulnerable versions This...

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...

GHSA-322M-FF4G-9VX9 Ghost: Server-Side Request Forgery in Bookmark Fetching

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This...

Ghost: Stored XSS via Bookmark Card Images

Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...

GHSA-347Q-26QQ-H2P6 Ghost: Stored XSS via Bookmark Card Images

Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...