EUVD-2026-68237

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651

SiYuan before v3.8.1 fails to apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. Although these routes require admin authentication , they construct file paths independently, allowing an authentica...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-77831

AshPaperTrail (an Elixir library from the ash-project ecosystem) contains an inefficient algorithmic complexity vulnerability in its full-diff list change tracking component (AshPaperTrail.ChangeBuilders.FullDiff.ListChange). The root cause is a cubic-time algorithm: when pairing prior array elem...

CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

EEF-CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Summary Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-82651: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

PT-2026-88956

Name of the Vulnerable Software and Affected Versions GitPython version 3.1.59 Description The high-level diff API fails to restrict the --no-index option, which allows attackers to read arbitrary filesystem paths as repository operands. By combining --no-index with -I/--ignore-matching-lines, an...

CVE-2026-56289

A flaw was found in GNU patch. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted patch file. The improper validation of hunk single block of changes in diff line offsets in unified-diff input can lead to an effectively infinite processin...

openSUSE 16 Security Update : kitty (openSUSE-SU-2026:21599-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21599-1 advisory. Changes in kitty: - Update to 0.48.2: Wayland: Fix regression in previous release that broke drag and drop on Plasma 10284 diff kitten: Fix a ra...

OPENSUSE-SU-2026:21599-1 Security update for kitty

This update for kitty fixes the following issues: Changes in kitty: - Update to 0.48.2: Wayland: Fix regression in previous release that broke drag and drop on Plasma 10284 diff kitten: Fix a rare crash when showing a large diff due to incorrect locking when highlighting Allow the private DCS...

SUSE-SU-2026:23210-1 Security update for patch

This update for patch fixes the following issues - CVE-2021-45261: Invalid Pointer via anotherhunk function bsc1194037. - CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence bsc1271167. - CVE-2026-56289: improper validation of hunk line offsets can lead to denial of...

Unity Linux 20.1070e Security Update: patch (UTSA-2026-099445)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099445 advisory. GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newli...

CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-74566 keys: make keyring key-chunk byte order agree with keyring_diff_objects()

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, flux-source-controller, flux, cilium-cli, kots, kuma, rancher-fleet-fips, helm-diff, gitlab-operator-fips, flux-fips, rancher-fleet, zarf-fips, gitlab-operator, cert-manager-cmctl, cert-manager-cmctl-fips, helm-diff-fips, zarf, helm-push...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, flux-source-controller, flux, cilium-cli, kots, kuma, rancher-fleet-fips, helm-diff, gitlab-operator-fips, flux-fips, rancher-fleet, zarf-fips, gitlab-operator, cert-manager-cmctl, cert-manager-cmctl-fips, helm-diff-fips, zarf, helm-push...

DRUPAL-CONTRIB-2026-096

This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...

JLSEC-2026-1261 GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single...

GNU patch is vulnerable to a denial of service DoS due to improper validation of hunk single block of changes in diff line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop...