CVE-2026-86112: Authorization Bypass Through User-Controlled Key

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

Linux Distros Unpatched Vulnerability : CVE-2026-84989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the REST v2 delete handlers for notification endpoints and recipients (in endpoints.lua and recipients.lua). An authenticated non-administrator user can issue POST requests to irreversibly delete all configured notification endpoin...

CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

GHSA-7Q9C-HPX7-9CWM TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

EUVD-2026-58516

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation...

EUVD-2026-60376

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds...

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

GHSA-8737-QX52-HJFF vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

EUVD-2026-57452

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password...

EUVD-2026-57453

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers...

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72793. Summary /api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields...

GHSA-H4V5-CRX2-3CV4 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72793. Summary /api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields...

EUVD-2026-57455

SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...

GHSA-34FJ-MWM6-FJFG SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...

EUVD-2026-57457

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers...

GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...

CVE-2026-12878

A flaw was found in the Codefresh platform. An authenticated user can exploit an API endpoint to elevate their privileges to administrative permissions, potentially gaining full control over the platform...