SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped...
CVE-2026-72801
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthen
#cwe-522
共收录 306 条相关情报。
← 返回所有主题siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system...
CVE-2026-72794
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthen
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system...
CVE-2026-72793
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve...
CVE-2026-72801
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthen
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the...
CVE-2026-72794
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthen
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-c...
CVE-2026-72793
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this...
CVE-2026-49349
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvert
Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-62882
Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing ove
Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-62839
Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing ov
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system...
CVE-2026-71577
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This a...
CVE-2026-71577
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026.
CVE-2026-12984
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. T
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRU...
CVE-2026-47662
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-subm...
CVE-2026-47660
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific confi...
CVE-2026-21766
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive...
CVE-2026-56570
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0,...
CVE-2026-17349
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file template...
CVE-2026-52855
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account id...
CVE-2026-56570
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone()...
CVE-2026-17349
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of