File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute...
CVE-2026-71620
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a craft
#advisory
共收录 23717 条相关情报。
← 返回所有主题SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password
CVE-2026-72792
**CVE:** This vulnerability corresponds to [CVE-2026-72792](https://nvd.nist.gov/vuln/detail/CVE-2026-72792). ### Summa
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key a...
CVE-2026-72793
**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793). ### Summa
SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
CVE-2026-72795
**CVE:** This vulnerability corresponds to [CVE-2026-72795](https://nvd.nist.gov/vuln/detail/CVE-2026-72795). ### Summa
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
CVE-2026-72794
**CVE:** This vulnerability corresponds to [CVE-2026-72794](https://nvd.nist.gov/vuln/detail/CVE-2026-72794). ### Summa
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers
CVE-2026-72796
**CVE:** This vulnerability corresponds to [CVE-2026-72796](https://nvd.nist.gov/vuln/detail/CVE-2026-72796). ### Summa
SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
CVE-2026-72797
**CVE:** This vulnerability corresponds to [CVE-2026-72797](https://nvd.nist.gov/vuln/detail/CVE-2026-72797). ### Summa
SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
CVE-2026-72798
**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798). ### Summa
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE-2026-72799
**CVE:** This vulnerability corresponds to [CVE-2026-72799](https://nvd.nist.gov/vuln/detail/CVE-2026-72799). ### Summa
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions
CVE-2026-63733
A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own che
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
CVE-2026-63735
An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
CVE-2026-85786
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a den
Unverified access point ownership in Amazon EFS CSI Driver
CVE-2026-85781
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server...
CVE-2026-9317
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticate
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry...
CVE-2026-80903
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit fa
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong...
CVE-2026-80906
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sendin
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail...
CVE-2026-80904
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed a
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix...
CVE-2026-80911
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an...
CVE-2026-85636
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the...
CVE-2026-82538
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where t