CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554

Note Mark (open-source note-taking application) is vulnerable to unauthenticated disclosure of soft-deleted note metadata prior to v0.19.5 . The unauthenticated GET /api/books/{bookID}/notes endpoint accepts a deleted query parameter; when set to true, the service calls Unscoped() to bypass GORM'...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-56127

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-56128

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...

GHSA-78X9-FHHX-V2G6 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

macnoise v0.5.0

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

EUVD-2026-70498

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

EUVD-2026-70496

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-56127

pfSense Plus before 26.07 and pfSense CE before 2.9.0 are affected by a stored XSS in /firewall_rules_edit.php. An authenticated user holding the Firewall: Rules: Edit privilege can inject arbitrary JavaScript via the descr parameter. The rule description is persisted in the pfSense XML configura...

CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

Astra Linux – Vulnerability in udisks2

A flaw was discovered in udisks2. A local attacker with an active console session can exploit insufficient authorization checking for the “as-user” option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to forge the “as-user” parameter, mounting file systems...

zafrida-ui v0.3.7

中文 | English ZAFrida UI - PyCharm Frida Plugin Current Version: 0.3.6 Project Introduction Frida GUI Tool for PyCharm/IntelliJ ZAFrida UI is a Frida graphical interface plugin integrated into PyCharm and JetBrains IDEs. It aims to solve the complexity of Frida command-line operations and script...