EUVD-2026-61055

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

PT-2026-77253

Name of the Vulnerable Software and Affected Versions EPSON 150075647YWWV110 EasyMP Network Updater version 1.20 Description A verification bypass allows the Epson projector to be updated using encrypted firmware via USB. Recommendations At the moment, there is no information about a newer versio...

CVE-2021-43716: Improper Verification of Cryptographic Signature

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB...

BIT-MONGODB-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100878)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100878 advisory. An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

PT-2026-71654

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.0 through 3.2.3 rsync-ssl versions prior to 3.4.5 Description A TLS certificate validation issue allows on-path attackers to intercept encrypted sessions by presenting self-signed or invalid certificates. This occurs because...

Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v684-q882-jgmq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly...

Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f2rw-w22v-54vh. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus...

CVE-2026-72797

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72789

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72797

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72797

SiYuan prior to v3.7.4 contains an information-disclosure vulnerability in the getEncryptedNotebookStatus endpoint. The endpoint returns encrypted notebook identifiers, names, and lock states without publish-access filtering, allowing anonymous readers and publish-mode accounts to enumerate all e...

CVE-2026-72797 SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72789

CVE-2026-72789 — SiYuan prior to v3.7.4 exposes encrypted notebooks via the publish API without authentication. The vulnerability arises from failing to properly validate publish access, causing anonymous readers to enumerate and retrieve fully decrypted content from unlocked encrypted notebooks....

CVE-2026-72789 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72789

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72789 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72793: Insufficiently Protected Credentials

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...

CVE-2026-72808: Missing Authorization

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...