SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...

GHSA-3CC2-H3V6-RQPQ SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...

EUVD-2026-60085

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint /ws/network/proxy via explicit CheckOrigin: true bypass...

CVE-2026-82045

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

EUVD-2026-91801

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82045 UTMStack < 11.2.16 JPQL Injection via searchPropertyValues

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82040

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040

UTMStack versions before 11.2.16 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the IdentityProviderService.validateMetadataUrl() function. Authenticated attackers can exploit the POST/PUT /api/identity-providers endpoint because the application fails to validate the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

EUVD-2026-91792

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-96940

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958

Loom for AWS versions before 1.7.0 are vulnerable to a Server-side request forgery (SSRF) in the tool server and remote agent connection handling. An authenticated remote user can exploit this by supplying a crafted connection address during the registration, updating, or testing of a tool server...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

EUVD-2026-91771

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network...

CVE-2026-96940

A weak authorization vulnerability in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. The vulnerability is confirmed and is addressed in several security updates, including KB5129955 (Subscription Edition RTM), KB5129956 (2019 CU15), KB5129957 (201...

CVE-2026-83663

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a...

Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive...