CVE-2026-74799 SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...

CVE-2026-74799

SiYuan (note-taking app) before version 3.7.4 registers Go net/http/pprof debug endpoints (e.g., /debug/pprof/heap, goroutine dumps) without authentication whenever the --mode flag is not exactly prod. An unauthenticated network attacker can request these endpoints to extract in-memory secrets, i...

CVE-2026-49304

Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2026-49304

CVE-2026-49304 describes a permission control vulnerability in the device key management module with an availability impact. The CVSS 3.1 base score is 6.2 (Medium) with LOCAL attack vector, LOW attack complexity, NO privileges required, and NO user interaction; impact is limited to Availability ...

EUVD-2026-60071

Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49304

Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-19999

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulati...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

BIT-NODE-MIN-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601 Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

EUVD-2026-60025

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

CVE-2026-50601 affects the Planet9 desktop application, where a hardcoded read-only API key allows unauthorized access to internal repositories. An attacker could use this access to extract embedded administrative keys and secrets, potentially gaining administrative control over repository infras...

CVE-2026-51977

Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera v1.0 exposes its RSA private key, enabling a physically proximate attacker to escalate privileges. CVSS 9.1 (critical) reflects high confidentiality and integrity impact. A proof-of-concept exists per CISA SSVC data. No patch version or reme...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...