Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...

EUVD-2026-41147

Wagtail: Improper restriction handling on Documents and Images chosen endpoints...

EUVD-2026-60587

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

CVE-2026-14229

The ECS WordPress plugin before version 4.3.8 lacks capability and post-status checks on its AJAX rendering action (ecsload), allowing unauthenticated attackers to retrieve rendered content of unpublished posts (private, draft, pending) by supplying a document identifier. CVSS 5.3 MEDIUM; CISA fl...

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-73049 SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

PT-2026-72010

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getAttributeViewBacklinks' endpoint. The system incorrectly consults the forbidden access list instead of the visibility list when filtering backlinks...

CVE-2026-73606

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

CVE-2026-18622 Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

CVE-2026-72804

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72805 SiYuan before v3.7.4 Information Disclosure via Block Endpoints

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

CVE-2026-72805

Affected software: SiYuan before v3.7.4. Root cause: endpoints getBlockBreadcrumb, getRefText, and getBlockTreeInfos do not enforce publish-access checks. Impact: anonymous readers or publish RoleReader accounts can disclose document titles, ancestor block content snippets, reference text, and pa...

CVE-2026-72804

SiYuan before v3.7.4 has an authentication bypass in the getGraph and getLocalGraph endpoints due to failure to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and view the complete reference topology without supply...

CVE-2026-72792

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

EUVD-2026-57452

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-72792

SiYuan before version 3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that reveals tag labels and occurrence counts from password-protected documents to unauthenticated readers, enabling enumeration of vocabulary and internal terminology without the document...