37375 matches found
CVE-2026-43890
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route...
ECHO-21A6-33D6-5465
Bulletin has no description...
CVE-2026-41674
A flaw was found in xmldom and @xmldom/xmldom, a JavaScript library for parsing and serializing XML. This vulnerability allows an attacker to inject arbitrary XML markup into a document due to improper handling of DocumentType node fields during serialization. By crafting malicious input, an...
MINI-P2XF-XW8J-MQ6W
Bulletin has no description...
MINI-6CP3-R6XR-PH2Q
Bulletin has no description...
MINI-P8JJ-8R52-4795
Bulletin has no description...
MINI-HJH9-PX7X-9RP6
Bulletin has no description...
MINI-72QC-CJ34-GCQW
Bulletin has no description...
CGA-2V28-9JF9-HRQC
Bulletin has no description...
CVE-2026-42889
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...
CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...
CVE-2026-42889
Summary (CVE-2026-42889): Relay Server (used with Obsidian) versions 0.9.0–0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were treated as having full server permissions, all...
CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...
MINI-4H23-67GQ-XPVW
Bulletin has no description...
MINI-3XGC-53CX-FF5F
Bulletin has no description...
MINI-3Q3M-F8VH-FCC8
Bulletin has no description...
Logged-in user bypasses share password and download restrictions on Text attachments via documentId
None...
MINI-W737-RP7H-6X4Q
Bulletin has no description...