3271 matches found
SiYuan Note <= 3.6.5 - Authentication Bypass
SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0. id: CVE-2026-54069 info:...
vLLM 0.8.3 - 0.14.0 - Information Disclosure
vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....
SiYuan Note - Cross-Site Scripting
SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting XSS in the /api/icon/getDynamicIcon endpoint due to improper filtering of SVG elements with a namespace prefix such as . By using a namespaced script element, attackers can bypass the SanitizeSVG...
SiYuan Note - Cross-Site Scripting
Unauthenticated reflected cross-site scripting XSS vulnerability in all versions of SiYuan Note containing /api/icon/getDynamicIcon with unsafe type=8 rendering logic. Attacker-controlled content is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary...
MINI-H296-GQ2G-CCX4
Bulletin has no description...
CVE-2026-5219
Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...
DEBIAN-CVE-2026-17775
Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI
The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....
MINI-CW43-M94F-QPCC
Bulletin has no description...
MINI-X9XR-398W-CJP9
Bulletin has no description...
MINI-P684-WHFF-JG7V
Bulletin has no description...
MINI-4W94-RMX5-VGXH
Bulletin has no description...
CVE-2026-17497
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...
PT-2026-64811
Name of the Vulnerable Software and Affected Versions NoteGen versions prior to 0.32.0 Description Cross-site scripting occurs when AI chat responses are rendered using markdown-it with the html:true configuration and injected into the DOM via dangerouslySetInnerHTML in the chat-preview component...
MINI-QQHP-FW37-7CRP
Bulletin has no description...
MINI-X7H4-J322-3GQ4
Bulletin has no description...
PT-2026-64353
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur during the removal of a shared GPIO proxy's parent. This issue stems from an excessively wide critical section using a mutex embedded in the gpio shared entry...