EUVD-2026-76858

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

PT-2026-90651

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 Description Logged-in users can record likes on password-protected and group-restricted videos because the software fails to validate video access permissions in the...

PT-2026-90641

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 Description An authorization failure exists in the 'adsInfo' API endpoint. Unauthenticated attackers can access this endpoint by providing the videos id parameter to...

CVE-2026-90545: Missing Authorization

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...

PT-2026-90645

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

PT-2026-90654

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CVE-2026-81861 affects Schneider Electric SCADAPack and stems from CWE-522 (Insufficiently Protected Credentials) in the Secure Lock component. The flaw could expose authentication information and permit unauthorized access to RTU functionality . The CVSS 4.0 base score is 5.9 (MEDIUM) , with a n...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861: Insufficiently Protected Credentials

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

PT-2026-89892

Name of the Vulnerable Software and Affected Versions SCADAPack 47x affected versions not specified SCADAPack 47xi affected versions not specified SCADAPack 47xd affected versions not specified SCADAPack 470R affected versions not specified SCADAPack 57x affected versions not specified SCADAPack...

EUVD-2026-75752

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-18994

CVE-2026-18994 is a potential improper authorization vulnerability in the Lenovo File Manager Android Application , which is distributed exclusively in the Chinese market. A local authenticated user could read or modify protected files within the application. Lenovo rates this HIGH severity with ...

GO-2026-6427 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password in github.com/siyuan-note/siyuan/kernel

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password in github.com/siyuan-note/siyuan/kernel...

GO-2026-6407 SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel...

GO-2026-6404 SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes name, alias, memo, custom fields of protected documents in github.com/siyuan-note/siyuan/kernel...

GO-2026-6388 SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel

SiYuan: Password protected tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password publish mode in github.com/siyuan-note/siyuan/kernel...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...