CVE-2026-34376

PdfDing is vulnerable prior to version 1.7.0 due to an access-control flaw that allowed unauthenticated retrieval of password‑protected shared PDFs via the direct file‑serving endpoint without completing the password verification flow. This could expose confidential documents intended to be prote...

CVE-2026-34072

CrnMaster cronmaster is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s...

Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

Impact An authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property an "array-like" obje...

EUVD-2026-17504

Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value...

GHSA-MMG8-87C5-JRC2 Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

Impact An authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property an "array-like" obje...

ROS-20260401-73-0049

Vulnerability in zabbix7-lts related to a flaw in the authorization mechanism. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

ROS-20260401-73-0048

Vulnerability in zabbix-lts related to a flaw in the authorization mechanism. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

ROS-20260401-73-0001

A vulnerability in the HTML Style Checker module of RoundCube Webmail is related to incorrect encoding or escaping of output data. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the davinci_cpufreq_probe() function in the drivers/cpufreq/davinci-cpufreq.c module of the Linux kernel’s frequency scaling driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the davincicpufreqprobe function in the drivers/cpufreq/davinci-cpufreq.c module of the Linux kernel frequency scaling driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the mhi_init_mmio() function in the drivers/bus/mhi/host/init.c file of the MHI bus driver for Linux kernel exposes the confidentiality, integrity, and accessibility of protected information to be compromised by attackers.

The vulnerability of the mhiinitmmio function in the drivers/bus/mhi/host/init.c file of the MHI bus driver for Linux operating systems is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

The vulnerability of the _create_query_function() function in the application programming interface of OpenStack Vitrage’s failure analysis and management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the createqueryfunction function in the application programming interface of OpenStack Vitrage’s failure analysis and fault management software is related to the lack of measures taken to neutralize the instructions in the dynamically executed code. Exploiting this...

The vulnerability of the self.config.as_dict() function in the Glances monitoring tool’s application programming interface allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the self.config.asdict function in the Glances monitoring tool’s application programming interface is related to the disclosure of information. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information...

The vulnerability of the IBM QRadar SIEM system’s event collection and analysis process, related to the leakage of information about files and directories, allows attackers to expose the protected information.

The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to the leakage of information about files and directories. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the release_module_tags() function in the lib/alloc_tag.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the releasemoduletags function in the lib/alloctag.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability in the `drivers/gpu/drm/amd/pm/swsmu/smu_internal.h` file of the amdgpu driver in the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the drivers/gpu/drm/amd/pm/swsmu/smuinternal.h file of the amdgpu driver in the Linux operating system is related to a memory leak. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

GHSA-C77M-R996-JR3Q SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

Summary The publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccessnil, .... Because the filter treats a nil context as authorized,...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getBookmark function. An attacker can retrieve sensitive content from password-protected documents by sending unauthenticated requests to the /api/bookmark/getBookmark endpoint, which improperly authorize...

SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

Summary The publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccessnil, .... Because the filter treats a nil context as authorized,...

Improper Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authorization via the afterFind process. An attacker can gain unauthorized access to protected files by sending HTT...

CVE-2026-34453

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling...