SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

NPM: stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

NPM: stream-json: pick/ignore/filter/replace filters are Odepth² on nested input — small crafted JSON blocks the event loop for seconds→minutes DoS vulnerability discovered by ? in WordPress Npm stream-json versions = 3.4.0...

OPENSUSE-SU-2026:21755-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276667...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-19795

IBM Qiskit SDK versions 2.1.0 through 2.5.1 are vulnerable to a denial of service when deserializing QPY files . The root cause is improper handling of a specially crafted object during deserialization, which may overflow the available stack space and trigger a segmentation fault , crashing the a...

EUVD-2026-70714

IBM Qiskit SDK 2.1.0 through 2.5.1 could allow a local attacker to cause a denial of service due to improper handling of a specially crafted object during deserialization. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

GHSA-P95V-992W-H6C3 TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

EUVD-2026-70712

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Google Chrome on iOS prior to version 152.0.7977.82 is vulnerable to a remote code execution flaw due to improper input validation within the Transactions Platform . A remote attacker could exploit this by using a crafted HTML page to potentially execute arbitrary code outside the sandbox. The vu...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

EUVD-2026-70657

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

EUVD-2026-66332

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...