CVE-2026-116208

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...

CVE-2026-116208

YesWiki versions 4.6.2 before 4.7.0 are vulnerable to a missing authorization flaw in the ActivityPubService::syncActorPosts component. This issue allows malicious ActivityPub servers to manipulate the mirrored entries of other actors. During an admin-initiated sync, an attacker can provide a poi...

CVE-2026-116208 YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...

EUVD-2026-109466

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...

YesWiki authorization issue vulnerability

Versions 4.6.2 through 4.7.0 of YesWiki contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in ActivityPubService::syncActorPosts. A malicious ActivityPub server can, during an administrator-initiated sync, inject malicious outbox entries tha...

PT-2026-123049

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...

CVE-2026-92880

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcmreadcoefsbe of the file src/coding/vadpcmdecoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible...

PT-2026-87071

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

PT-2026-84745

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...

EUVD-2026-15443

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validatio...

CVE-2026-20113

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validatio...

ROS-20250616-03

A vulnerability in the Rack module interface of the Ruby programming language interpreter is related to insufficient insufficient validation of data provided by an attacker in Rack::CommonLogger. Exploitation of the vulnerability could Allow an attacker acting remotely to manipulate data log entr...

openSUSE 15: ruby2.5-rubygem-rack-1_6 / ruby2.5-rubygem-rack-doc-1_6 / etc (SUSE-SU-2025:0858-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0858-1 advisory. - CVE-2025-27610: Fixed improper sanitization of user-supplied paths when serving files leading to local file inclusion bsc1239298. - CVE-2025-25184:...

Security update for rubygem-rack-1_6

This update for rubygem-rack-16 fixes the following issues: CVE-2025-27610: Fixed improper sanitization of user-supplied paths when serving files leading to local file inclusion bsc1239298. CVE-2025-25184: Fixed Rack::CommonLogger log entry manipulation bsc1237141. Patch Instructions: To install...

SUSE-SU-2025:0858-1 Security update for rubygem-rack-1_6

This update for rubygem-rack-16 fixes the following issues: - CVE-2025-27610: Fixed improper sanitization of user-supplied paths when serving files leading to local file inclusion bsc1239298. - CVE-2025-25184: Fixed Rack::CommonLogger log entry manipulation bsc1237141...

CVE-2025-25184

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

CVE-2002-2050

Directory traversal vulnerability in processorweb plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. dot dot in the hostname of a log entry...