EUVD-2026-84198

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...

CVE-2026-58270

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270: Inefficient Regular Expression Complexity

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651

SiYuan before v3.8.1 fails to apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. Although these routes require admin authentication , they construct file paths independently, allowing an authentica...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

PT-2026-69188

Name of the Vulnerable Software and Affected Versions Kirachon context-engine versions prior to 1.9.1 Description Command injection is possible within the review-git-diff Endpoint due to improper handling of the args variable in the execGitCommand function located in the src/mcp/utils/gitUtils.ts...

PT-2026-59346

Summary Open WebUI's prompt version-history endpoints authorize the prompt id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt history entry.prompt id == prompt.id. Three operations are affected: - GET /api/v1/prompts/id/prompt...

CVE-2026-9132

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range an...

CVE-2026-9132 Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range an...

CVE-2026-9132 Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range an...

CVE-2026-9132

CVE-2026-9132 describes a missing authorization flaw in GitHub Enterprise Server where an authenticated user could read source code from private repositories via the Copilot pull request description diff summary endpoint. The vulnerability allowed a user with read access to at least one repositor...

CVE-2026-47193

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-47193 OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-47193

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

EUVD-2026-39872

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-47193

OpenProject (open-source web-based project management) contains a vulnerability in the journal diff endpoint that discloses hidden historical field values due to lack of object/field visibility enforcement. The issue is fixed in versions 17.3.3 and 17.4.1. Affected component: journal diff endpoin...

PT-2026-52907

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...