CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

CVE-2026-85583

SiYuan versions prior to v3.8.2 are affected by a path traversal vulnerability in the reader-accessible file-read endpoint. The root cause is that the endpoint follows symlinks when opening authorized asset paths, allowing an attacker with the reader role to request a logical asset under data/ass...

CVE-2026-85583 SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

CVE-2026-85578 SiYuan through 3.8.1 Authorization Bypass via getFile

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass in the /api/file/getFile endpoint. Attackers with reader role can retrieve files from notebooks explicitly configured as Visible:false , gaining access to private workspace files including notebook metadata and internal configuration by knowin...

CVE-2026-85578 SiYuan through 3.8.1 Authorization Bypass via getFile

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

EUVD-2026-70912

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-75168

MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) contains a vulnerability in the ugw-editfile method of /cgi-bin/wwwugw.cgi that allows a remote, authenticated user holding the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. The CVSS 3.1 ba...

CVE-2026-75169

CVE-2026-75169 is an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user with Admin role can upload files with arbitrary content to hardcoded paths , enabling full compromise (CVSS 8.8 HIGH , C...

CVE-2026-75167

MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is affected by a broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi. A remote authenticated user holding the low-privileged Standard role can change the password of arbitrary accounts , effectively allowing priv...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

EUVD-2026-71446

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-75164

CVE-2026-75164 is an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user holding the low-privileged Standard role can retrieve arbitrary files from the device filesystem by manipulating the fil...

Linux Distros Unpatched Vulnerability : CVE-2026-80726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its pare...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...