CVE-2026-66012

SiYuan before v3.7.2 has an unauthenticated access path via POST /mcp due to missing authorization enforcement (no admin/read-only role checks). In Publish anonymous mode, an anonymous RoleReader JWT can reach /mcp, enabling an attacker to read conf/conf.json (exfiltrating accessAuthCode, api.tok...

CVE-2022-49151

In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: properly check endpoint type Syzbot reported warning in usbsubmiturb which is caused by wrong endpoint type. We should check that in endpoint is actually present to prevent this warning. Found pipes are now saved to...

Information Disclosure

ezsystems/ezpublish-kernel is vulnerable to Information Disclosure. The /user/sessions endpoint allows an attacker to detect if a given username or email refers to a valid account through the differences in the response data or response time of certain requests...