2026

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthen

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing

SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoi

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymou

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass p

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and ge

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthen

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag l

SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information d

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly access

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to prope

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft na

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an auth

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an a

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated a

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions duri

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolatio

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During th

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrict

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerab

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerab

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoo

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to s

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoo

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker wh

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (includin

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authentica

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that u

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane co

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that u

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race c

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to imprope

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper n

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper n

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statement

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflo

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper val