The vulnerability of the software for implementing the hypertext environment MediaWiki, related to insufficient protection of operational data, allows a violator to gain unauthorized access to protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the go-git library, related to unvalidated array indexing, allows attackers to compromise the accessibility of protected information.

The vulnerability of the go-git library is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the accessibility of the protected information...

The vulnerability of the endpoint AssumeRoleWithLDAPIdentity of the STS (Security Token Service) server for MinIO object storage allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the endpoint of the STS Security Token Service, which manages MinIO object storage, is related to inconsistencies in response to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the software for implementing the hypertext environment MediaWiki, related to insufficient protection of operational data, allows a violator to gain unauthorized access to protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the final point of contact for the dynamic registration mechanism of the OAuth2 software used to manage medical organizations like OpenEMR, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the final point of contact for the dynamic registration mechanism of the OAuth2 software used to manage medical organizations like OpenEMR lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to gain unauthoriz...

The vulnerability of the Repo.clone_from() function in the Python library for interacting with Git repositories in GitPython allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the ImageMedium::watermark() function in the Grav CMS system allows a hacker to disclose protected information.

The vulnerability of the ImageMedium::watermark function in the Grav CMS system is related to an incorrect limitation on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

EUVD-2026-52855

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

Eclipse Milo 1.0.0–1.1.4 contains a bug in OpcUaServerConfig.copy() that fails to preserve a configured RoleMapper. On servers building running config via copy(), sessions may have no role IDs, causing the default access controller to skip role-permission checks. This enables an anonymous client ...

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system, related to insufficient input data validation, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

Duplicate Advisory: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7j72-f6wg-cxw6. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning...

EUVD-2026-52326

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...