PT-2026-99565

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.87.0 Description In the enterprise tier, two endpoints serving in-house iOS application packages and manifests lack the intended random, time-limited URL token protection. Since Apple's InstallEnterpriseApplication MD...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

EUVD-2026-60323

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238: Out-of-bounds Read

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

PT-2026-72012

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/filetree/authFilePublishAccess' endpoint, which is accessible anonymously. The endpoint does not return failure codes, instead signaling outcomes...

CVE-2026-73049: Incorrect Authorization

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

GHSA-V598-7627-G9FX Duplicate Advisory: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vpjw-wf5h-cgpq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowin...

PT-2026-85359

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vpjw-wf5h-cgpq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowin...

CVE-2026-10782: Missing Authorization

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-41187

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187

Summary: Calico’s apiserver fails to invoke the Delete override for DeleteCollection on tier-scoped policies (NetworkPolicy, GlobalNetworkPolicy and staged variants). This allows a user with deletecollection or wildcard verbs on tier-scoped policy resources to bulk-delete policies in tiers they w...

EUVD-2026-51154

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

PT-2026-66490

Name of the Vulnerable Software and Affected Versions Calico affected versions not specified Description The apiserver fails to invoke the Delete override for DeleteCollection requests on NetworkPolicy, GlobalNetworkPolicy, and their staged variants. This occurs because these resources are wrappe...