47260 matches found
CVE-2026-72801
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline...
CVE-2026-72801 SiYuan before v3.7.4 Information Disclosure via Encryption Key Material
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline...
EUVD-2026-57453
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...
CVE-2026-72794
CVE-2026-72794 affects Siyuan before v3.7.4. The vulnerability arises because the /api/system/getConf endpoint leaks the session cookie signing key to unauthenticated users in publish mode, enabling forgery of valid session cookies and potential user impersonation or administrative access. Affect...
CVE-2026-19228 Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...
CVE-2026-66016
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...
CVE-2026-73405
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...
CVE-2026-73264
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...
CVE-2026-66016
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...
EUVD-2026-57259
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...
CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...
CVE-2026-66016
CVE-2026-66016 concerns rendered Artifactory Helm manifests produced under specific self-hosted Helm configurations, where generated TLS private keys may be retained and become accessible to highly privileged local users. The CVSS-derived metrics in the initial entry indicate local attack vector,...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the numberrange scope of the backend filter widget when the conditions key is configured. An attacker can access sensitive database information by injecting arbitrary SQL through the filter's AJAX handler. This is only...
EUVD-2026-57225
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...
CVE-2026-73264
Prowler (cloud security platform) contains an SSRF risk prior to version 5.33.1. An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider via POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/...
CVE-2026-73405
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...
EUVD-2026-57223
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...
CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...
CVE-2026-73405
CVE-2026-73405 describes an authorization bypass in Vulnerability-Lookup where the Pub/Sub SSE interface allowed unconfirmed/inactive accounts to subscribe to /pubsub/subscribe/ due to token_required only validating the API key, not is_active/is_confirmed. This created a boundary mismatch with th...
CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...