SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only p...

CVE-2026-103762

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a

历史摘要 · 未重新核验 · NVD

YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unaut

历史摘要 · 未重新核验 · OSV.dev

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

CVE-2026-104467

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenti

历史摘要 · 未重新核验 · OSV.dev

YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

CVE-2026-104438

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the

历史摘要 · 未重新核验 · OSV.dev

SiYuan before 3.8.5 Information Disclosure via /api/export/preview

CVE-2026-104410

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protec

历史摘要 · 未重新核验 · OSV.dev

SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

CVE-2026-103762

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a

历史摘要 · 未重新核验 · OSV.dev

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin n...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all version

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chat...

CVE-2026-80337

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Proper

历史摘要 · 未重新核验 · NVD

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account ...

CVE-2026-97219

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing

历史摘要 · 未重新核验 · NVD

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read ...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the Wo

历史摘要 · 未重新核验 · NVD

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing...

CVE-2026-85005

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and ex

历史摘要 · 未重新核验 · NVD

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users wit...

CVE-2026-79618

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its

历史摘要 · 未重新核验 · NVD

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allow...

CVE-2026-91023

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing befor

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function...

CVE-2026-104054

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component P...

CVE-2026-104054

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

历史摘要 · 未重新核验 · NVD

calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

CVE-2026-104054

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki

历史摘要 · 未重新核验 · OSV.dev

A component of one of the Motorola system applications was exported without permission, allowing...

CVE-2026-93832

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of r

历史摘要 · 未重新核验 · GitHub Advisory

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps.

CVE-2026-93832

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of r

历史摘要 · 未重新核验 · NVD

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent r...

### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by comm

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

CVE-2026-73609

### Summary `/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It

历史摘要 · 未重新核验 · GitHub Advisory