CVE-2026-101092

SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...