EUVD-2026-57458

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases ...

EUVD-2026-54229

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-70557

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-70557

The connected documents confirm a concrete vulnerability in diboot-core: POST /common/load-related-data allows an authenticated user to resolve any caller-supplied field name to any @TableField column across all entities and return those values, because there is no field or entity allowlist and r...

CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-18275

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-18275

CVE-2026-18275 affects Scripta eScriptorium (up to version 26.04.1). An authorization bypass lies in the process and annotation taxonomy serializers, enabling a remote authenticated user to perform segmentation and transcription against other users’ document parts, overwriting content. The root c...

EUVD-2026-54090

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-18602

creationtimestamp| type| source ---|---|--- 2026-08-04 16:00:44+00:00| seen| https://www.acn.gov.it/portale/w/gl-inet-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-18601-cve-2026-18602-cve-2026-18612-cve-2026-18616 2026-08-05 01:00:34+00:00| seen|...

CVE-2026-18577

creationtimestamp| type| source ---|---|--- 2026-08-03 10:00:37+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0275 2026-08-03 10:00:37+00:00| seen| https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html 2026-08-03 12:21:24+00:00| seen|...

CVE-2026-44103 JupiCore does not perform validation of firmware

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...

BELL-CVE-2026-64403

Bulletin has no description...

CVE-2026-14059

An insufficient policy enforcement flaw was found in the Related-Website-Sets component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502363986...

CVE-2026-57990

creationtimestamp| type| source ---|---|--- 2026-07-26 19:24:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrl4bebryp2w 2026-07-26 20:31:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrl7y2wi472o 2026-07-26 23:07:58+00:00| seen|...

DEBIAN-CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

MINI-PW26-FJRM-4PM9

Bulletin has no description...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-60373

creationtimestamp| type| source ---|---|--- 2026-07-23 00:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjuumq222d 2026-07-23 01:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbngwj6ip2i 2026-07-23 17:23:15+00:00| seen|...