CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

CVE-2026-74895

openssl_encrypt (Python package) versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution, allowing attackers to run malicious plugins with unrestricted filesystem, network, subprocess, and Python module access (CVSS 9.8 CRITICAL). No in-...

EUVD-2026-60114

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

EUVD-2026-60110

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891

The openssl_encrypt npm package (versions before 1.4.0) ships standalone server configuration files containing hardcoded, well-known default PostgreSQL credentials. Network-accessible attackers can connect to exposed PostgreSQL instances and retrieve sensitive data. No exploitation evidence is pr...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

EUVD-2026-60101

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74802 SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74802

SiYuan versions before 3.7.4 set the WebSocket CheckOrigin handler to unconditionally return true on the admin-only /ws/network/proxy endpoint, allowing cross-site WebSocket hijacking. A malicious webpage can make the victim's SiYuan kernel proxy arbitrary network traffic, enabling authenticated ...

EUVD-2026-60085

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

MINI-JGWM-FMRF-J2MG

Bulletin has no description...

MINI-MW32-3V5M-C3MG

Bulletin has no description...

BIT-JRE-2026-60166

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

BIT-JRE-2026-60164

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

BIT-JRE-2026-60147

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...