EUVD-2026-25626

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check IsSensitivePath but did not address the root cause — a redundant url.PathUnescape call in serveExport. An authenticated attacker can use double URL encoding...

CVE-2026-41894 SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check IsSensitivePath but did not address the root cause — a redundant url.PathUnescape call in serveExport. An authenticated attacker can use double URL encoding...

CVE-2026-31665

creationtimestamp| type| source ---|---|--- 2026-04-24 18:07:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116461014638911540 2026-04-27 20:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkiuc3bley2w 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-42040 Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode function in lib/helpers/AxiosURLSearchParams.js contains a character mapping charMap at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent'\x00' correctly...

CVE-2026-40976

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-04-27 05:23:49+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mkhdcsbjs22h 2026-04-28 01:01:21+00:00| seen|...

CVE-2026-40977

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e...

CVE-2026-40971

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-06-12 12:55:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3ry7mosb27...

CVE-2026-40970

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e...

CVE-2026-40538

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40532

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40539

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40535

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40530

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-4036

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-25660

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in...

CLSA-2026-1777029448 containernetworking-plugins: Fix of CVE-2026-25679

rebuild with newer golang version 1.25.7-1.el96.tuxcare.els2 to fix the following CVE - CVE-2026-25679: reject IPv6 literals not at the start of the host subcomponent in net/url.Parse to prevent URL authority validation bypass...

CLSA-2026-1772465492 podman: Fix of 4 CVEs

rebuild with newer golang version 1.25.7-1.el96.tuxcare.els1 to fix the following CVEs - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

CVE-2026-1845

creationtimestamp| type| source ---|---|--- 2026-04-24 10:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkad76ljud2a...

CVE-2026-1950

creationtimestamp| type| source ---|---|--- 2026-04-24 08:14:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mka3hjof4t2n 2026-04-24 09:16:19+00:00| published-proof-of-concept| Telegram/X1JyBiiNxoSYu-ldDRrQFjaq89QLca8O12-lN-DTEtiPeU 2026-05-11 19:37:07+00:00| seen|...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...