CVE-2026-72793

SiYuan before v3.7.4 exposes sensitive configuration data via /api/system/getConf. The root cause is failure to mask fields such as the session-cookie signing key, OS username (via pandoc path), and encrypted-notebook key material, enabling anonymous or publish-reader users to access these secret...

CVE-2026-72793 SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...

CVE-2026-72794 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

CVE-2026-72793 SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...

CVE-2026-72794

CVE-2026-72794 affects Siyuan before v3.7.4. The vulnerability arises because the /api/system/getConf endpoint leaks the session cookie signing key to unauthenticated users in publish mode, enabling forgery of valid session cookies and potential user impersonation or administrative access. Affect...

CVE-2026-72794 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

CVE-2026-18952

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

UBUNTU-CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

EUVD-2026-57326

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core prior to 4.5.14 and Nagios XI prior to 2026R1.7 are affected by a CSRF protection bypass via a self-supplied double-submit cookie. An attacker can craft a malicious link that, with a matching cookie and request parameters, bypasses CSRF protection and allows unauthenticated execution ...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-73264

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

CVE-2026-15213 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213

The CVE concerns the Welcart e-Commerce WordPress plugin prior to 2.11.33. The vulnerability lies in the settlement callback for convenience-store/bank-transfer payments, where there is no authenticity verification. An unauthenticated request can flip an order from unpaid to settled using only an...

CVE-2026-19050

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-19050

The ProSolution WP Client WordPress plugin (versions before 2.0.9 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs and does not verify the requester's capability or nonce before initiating server-side HTTP requests. Th...