85837 matches found
CVE-2026-74877
opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...
CVE-2026-74867
SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...
CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key
opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...
EUVD-2026-60096
opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...
CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key
opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...
CVE-2026-74877
openssl_encrypt versions before 1.4.0 contain a missing ownership verification flaw in the revoke_key method (keyserver/service.py, lines 195–270). The method accepts a client_id parameter but never verifies it matches key.owner_client_id, allowing any authenticated client to revoke another clien...
EUVD-2026-60094
opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...
CVE-2026-74869 stoatchat before 0.15.0 Missing Authorization via Subscribe
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...
CVE-2026-74869 stoatchat before 0.15.0 Missing Authorization via Subscribe
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...
CVE-2026-74869
StoatChat before version 0.15.0 has a missing-authorization flaw in the Subscribe message handler: authenticated users can send a Subscribe message with any arbitrary server ID and receive live UserUpdate events (display names, avatars, status) for members of private servers they are not part of....
EUVD-2026-60083
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...
MINI-5RQG-24M7-RGPG
Bulletin has no description...
MINI-RGRH-Q439-J3WV
Bulletin has no description...
MINI-J974-WW7P-9M8X
Bulletin has no description...
MINI-HW33-HVF2-6PGJ
Bulletin has no description...
MINI-RJ8H-R33H-HF69
Bulletin has no description...
MINI-2PGV-X79R-J57R
Bulletin has no description...
MINI-32F6-HG2M-3X99
Bulletin has no description...
MINI-VGR8-FHR3-8268
Bulletin has no description...
CVE-2026-15623
creationtimestamp| type| source ---|---|--- 2026-08-17 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117109674799093583 2026-08-17 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtb6mhhqql2f 2026-08-17 08:07:15+00:00| seen|...