GHSA-5W7R-F4CG-RQQ7 SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72799. Summary Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when...

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72799. Summary Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when...

EUVD-2025-210490

SurrealDB allows bypass of deny-net flags via DNS resolution...

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

CVE-2026-85700 Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

CVE-2026-85671

QAnything 2.0.0 contains an authentication bypass in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints. Unauthenticated attackers can enumerate file identifiers and retrieve base64-encoded files or parsed document chunks without ownership verification, enabling cross-t...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

EUVD-2026-71012

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

BIT-JOOMLA-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

BIT-JOOMLA-2026-72531 Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260804 - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components...

BIT-JOOMLA-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

CVE-2026-85667: Missing Authentication for Critical Function

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

PT-2026-85538

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-75160

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

PT-2026-85489

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...