🚨 CVE-2026-74802
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
🎖@cveNotify
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
🎖@cveNotify
GitHub
Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true`…
**High**
## Package
gomod `github.com/siyuan-note/siyuan/kernel`
## Affected versions
3.7.3
## Patched versions
*(none yet — leave blank until a fix is released)*
## Description
#...
## Package
gomod `github.com/siyuan-note/siyuan/kernel`
## Affected versions
3.7.3
## Patched versions
*(none yet — leave blank until a fix is released)*
## Description
#...
🚨 CVE-2026-50768
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.
🎖@cveNotify
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.
🎖@cveNotify
GitHub
CVEs/CVE-2026-50768 at main · Henkel-CyberVM/CVEs
CVE reports created by Henkel AG & Co. KGaA's Cyber Defense team. - Henkel-CyberVM/CVEs
🚨 CVE-2026-61231
Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
🎖@cveNotify
Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
🎖@cveNotify
🚨 CVE-2026-21584
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).
This vulnerability was reported via our Penetration Testing program.
🎖@cveNotify
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).
This vulnerability was reported via our Penetration Testing program.
🎖@cveNotify
🚨 CVE-2026-66358
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
🎖@cveNotify
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
🎖@cveNotify
jvn.jp
JVN#47716829: Multiple vulnerabilities in acmailer
Japan Vulnerability Notes
🚨 CVE-2026-75628
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter.
oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`.
A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.
🎖@cveNotify
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter.
oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`.
A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.
🎖@cveNotify
IETF Datatracker
RFC 9700: Best Current Practice for OAuth 2.0 Security
This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new…
🚨 CVE-2026-73542
Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information.
🎖@cveNotify
Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information.
🎖@cveNotify
jvn.jp
JVNVU#91609598: Multiple SEIKO EPSON printers and scanners keep already revoked root certificates
Japan Vulnerability Notes
🚨 CVE-2026-71368
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.
🎖@cveNotify
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.
🎖@cveNotify
f-revocrm.jp
F-RevoCRMバージョン7系以降の脆弱性と対応について | F-RevoCRM[エフレボCRM]－オープンソースの顧客管理システム
平素よりF-RevoCRMをご利用いただき誠にありがとうございます。 この度、F-RevoCRMバージョン7系以降（7系・8系）において脆弱性が発見されました。それに伴い本日リリースのF-RevoCRM 8.0.4&n
🚨 CVE-2026-21784
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
🎖@cveNotify
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL IntelliOps Event Management (IEM) - Customer Support
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-15743
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.
The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)
Configuring the expires time to "0" to disable caching, as documented, is ignored.
🎖@cveNotify
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.
The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)
Configuring the expires time to "0" to disable caching, as documented, is ignored.
🎖@cveNotify
IETF Datatracker
RFC 9111: HTTP Caching
The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document defines HTTP caches and the associated header fields that control cache behavior or indicate cacheable…
🚨 CVE-2026-64773
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
🎖@cveNotify
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
🎖@cveNotify
GitHub
TCP port forwarder buffers unbounded pre-connect data from published container ports
## Impact
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory...
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory...
🚨 CVE-2026-76131
Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.
🎖@cveNotify
Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.
🎖@cveNotify
jvn.jp
JVNVU#90210212: Multiple vulnerabilities in Yamaha VOCALOID6 Editor
Japan Vulnerability Notes
🚨 CVE-2026-76137
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
🎖@cveNotify
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
🎖@cveNotify
jvn.jp
JVNVU#90210212: Multiple vulnerabilities in Yamaha VOCALOID6 Editor
Japan Vulnerability Notes
🚨 CVE-2026-73537
Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered.
🎖@cveNotify
Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered.
🎖@cveNotify
jvn.jp
JVN#09266484: Miraikan Assist App vulnerable to cross-site scripting
Japan Vulnerability Notes
🚨 CVE-2026-13598
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
🎖@cveNotify
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
🎖@cveNotify
WPScan
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
See details on RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator CVE 2026-13598. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-59561
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".
🎖@cveNotify
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".
🎖@cveNotify
GitHub
Release v2.4.3 · sakura-editor/sakura
セキュリティ修正
「PowerShellを開く」機能でのOSコマンドインジェクション脆弱性を修正 (GHSA-6x2x-729r-wjh5 / JVN#74538868)
WSHマクロ経由のExecCmdスタックバッファオーバーフロー脆弱性を修正 (GHSA-g26p-p558-cmwj)
制御プロセス起動時、無制限プロファイル名によるスタックバッファオーバーフロー脆弱性を修正 (GHSA...
「PowerShellを開く」機能でのOSコマンドインジェクション脆弱性を修正 (GHSA-6x2x-729r-wjh5 / JVN#74538868)
WSHマクロ経由のExecCmdスタックバッファオーバーフロー脆弱性を修正 (GHSA-g26p-p558-cmwj)
制御プロセス起動時、無制限プロファイル名によるスタックバッファオーバーフロー脆弱性を修正 (GHSA...
🚨 CVE-2026-76843
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package.
🎖@cveNotify
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package.
🎖@cveNotify
GitHub
GitHub - flairNLP/flair: A very simple framework for state-of-the-art Natural Language Processing (NLP)
A very simple framework for state-of-the-art Natural Language Processing (NLP) - flairNLP/flair
🚨 CVE-2026-78416
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
🎖@cveNotify
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
🎖@cveNotify
GitHub
GitHub - craftcms/cms: Build bespoke content experiences with Craft.
Build bespoke content experiences with Craft. Contribute to craftcms/cms development by creating an account on GitHub.
🚨 CVE-2026-75368
A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted ECSS TC message.
🎖@cveNotify
A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted ECSS TC message.
🎖@cveNotify
GitHub
AcubeSAT C3 OBC Software: Stack Buffer Overflow in MemoryManagementService::loadRawData · Issue #3 · dazuo233/cve
📋 Summary A stack-based buffer overflow vulnerability exists in the loadRawData function of the AcubeSAT OBC (On‑Board Computer) software (commit eaf90ecf311c8728bf5f371175bce49c6a3f0ec0). When pro...
🚨 CVE-2026-66109
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
🎖@cveNotify
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
🎖@cveNotify
jvn.jp
JVN#33423625: Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Japan Vulnerability Notes
🚨 CVE-2026-68062
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.
🎖@cveNotify
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.
🎖@cveNotify
jvn.jp
JVN#33423625: Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Japan Vulnerability Notes