CVE-2026-68584

CVE-2026-68584 affects SiYuan before v3.7.3. An authentication bypass exists in publish mode: content endpoints that return headings or backlinks (getHeadingChildrenDOM, getHeading*Transaction, getBacklinkDoc) do not enforce the password check, even though the main getDoc endpoint is protected. A...

CVE-2026-69079

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082

CTI-Transmute exposes a CSRF vulnerability in the admin user-deletion endpoint: /account/delete/ accepts HTTP GET, allowing an attacker to induce an authenticated admin to delete a user via a forged request. Exploitation requires an active admin session but no CTI-Transmute account or admin privi...

CVE-2026-69079 Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

EUVD-2026-52255

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

CVE-2026-16564

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace,...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50010)

Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

CVE-2026-16564 Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace,...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-16564

The CVE-2026-16564 entry concerns the Dokan plugin (WordPress) prior to 5.0.9. The REST endpoint that handles bulk order-status changes does not verify order ownership, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders be...

CVE-2026-15383

The CVE-2026-15383 entry concerns the Blog Floating Button WordPress plugin (versions up to and including 1.4.20). Affected component: the visitor User-Agent header is not sanitized/escaped when stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator ...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2026-16540 Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently dele...

CVE-2026-16540

The CVE concerns the WordPress plugin Simply Schedule Appointments (before 1.6.12.6). The root cause is a purge_appointments REST handler that does not properly scope actions to the authenticated owner, enabling an unauthenticated user to access personal data across all appointments and, in premi...