🚨 CVE-2026-103762
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
🎖@cveNotify
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
🎖@cveNotify
GitHub
Publish readers learn unpublished notebook box IDs via save-path resolver endpoints missing a publish-access check in SiYuan
## Summary
Three notebook save-path resolver endpoints in the SiYuan kernel are registered with the base authentication middleware only and perform no publish-access authorization check. When th...
Three notebook save-path resolver endpoints in the SiYuan kernel are registered with the base authentication middleware only and perform no publish-access authorization check. When th...
🚨 CVE-2026-103763
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
🎖@cveNotify
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
🎖@cveNotify
GitHub
Publish readers read document count, size and timestamps of publish-excluded documents via /api/notebook/getNotebookInfo
## Summary
The HTTP endpoint `POST /api/notebook/getNotebookInfo` is registered with only the base authentication middleware and performs no document-level authorization. When a notebook is publ...
The HTTP endpoint `POST /api/notebook/getNotebookInfo` is registered with only the base authentication middleware and performs no document-level authorization. When a notebook is publ...
🚨 CVE-2026-104410
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
🎖@cveNotify
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
🎖@cveNotify
GitHub
Publish reader reads password-protected and publish-disabled database rows via /api/export/preview
## Summary
A publish reader can read the full contents of database (attribute-view) rows whose bound documents the owner marked password-protected or publish-disabled. The publish endpoint `POST...
A publish reader can read the full contents of database (attribute-view) rows whose bound documents the owner marked password-protected or publish-disabled. The publish endpoint `POST...
🚨 CVE-2026-104411
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
🎖@cveNotify
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
🎖@cveNotify
GitHub
Stored XSS via File Uploads on Local Storage
### Impact
Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was n...
Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was n...
🚨 CVE-2026-104412
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
🎖@cveNotify
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
🎖@cveNotify
GitHub
Editors Could Promote Staff Users to Their Own Role
### Impact
Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.
### Vulnerab...
Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.
### Vulnerab...
🚨 CVE-2026-104413
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
🎖@cveNotify
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
🎖@cveNotify
GitHub
Stored XSS via Bookmark Card Images
### Impact
When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors,...
When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors,...
🚨 CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
🎖@cveNotify
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
🎖@cveNotify
GitHub
Stored XSS via oEmbed Photo Responses
### Impact
Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site,...
Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site,...
🚨 CVE-2026-104415
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
🎖@cveNotify
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
🎖@cveNotify
GitHub
Password Hash Ordering Disclosure in Ghost Admin API
### Impact
Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a pr...
Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a pr...
🚨 CVE-2026-104416
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
🎖@cveNotify
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
🎖@cveNotify
GitHub
Invite Token Disclosure in Ghost Admin API
### Impact
Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This co...
Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This co...
🚨 CVE-2026-104417
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
🎖@cveNotify
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
🎖@cveNotify
GitHub
Path Traversal via Locale Setting
### Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing ...
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing ...
🚨 CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
🎖@cveNotify
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
🎖@cveNotify
GitHub
Remote Code Execution via Theme Translation Files
### Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
### Vulnerable versio...
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
### Vulnerable versio...
🚨 CVE-2026-104419
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
🎖@cveNotify
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
🎖@cveNotify
GitHub
Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocks
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L` = 4.8 (Medium) |
| Conditional (self-healing / negligible amplification) | Reclassify as h...
|---|---|
| Severity | Medium |
| CVSS 3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L` = 4.8 (Medium) |
| Conditional (self-healing / negligible amplification) | Reclassify as h...
🚨 CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.
🎖@cveNotify
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.
🎖@cveNotify
GitHub
Invalid gossiped blocks bypass peer misbehavior scoring
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` = 5.3 (Medium). |
| CWE | CWE-253 (Incorrect Check of Function Return Value) / C...
|---|---|
| Severity | Medium |
| CVSS 3.1 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` = 5.3 (Medium). |
| CWE | CWE-253 (Incorrect Check of Function Return Value) / C...
🚨 CVE-2026-104421
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
🎖@cveNotify
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
🎖@cveNotify
GitHub
Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)
# Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/...
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/...
🚨 CVE-2026-104422
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
🎖@cveNotify
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
🎖@cveNotify
GitHub
Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peer
# Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peer
| Field | Content |
|---|---|
| Severity | High |
| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C...
| Field | Content |
|---|---|
| Severity | High |
| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C...
🚨 CVE-2026-104423
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
🎖@cveNotify
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
🎖@cveNotify
GitHub
Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verification
# Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verification
| Field | Value |
|---|---|
| Severity | High |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:...
| Field | Value |
|---|---|
| Severity | High |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:...
🚨 CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.
🎖@cveNotify
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.
🎖@cveNotify
GitHub
Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processing
# Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processing
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/...
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/...
🚨 CVE-2026-104426
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.
🎖@cveNotify
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.
🎖@cveNotify
GitHub
Quadratic transparent value check in block contextual verification
# Quadratic transparent value check in block contextual verification
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9) |
| CWE | CWE-...
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9) |
| CWE | CWE-...
🚨 CVE-2026-104427
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.
🎖@cveNotify
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.
🎖@cveNotify
GitHub
Potential Chain Stall via stale `parent_error_map`
# Chain stall via stale parent_error_map entry after a poisoned-block rejection
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9) |
|...
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9) |
|...
🚨 CVE-2026-104428
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
🎖@cveNotify
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
🎖@cveNotify
GitHub
getblock verbosity 2 on a side-chain block panics the node via negative-confirmations u32 conversion
## Am I affected?
You are affected if you run an affected version and expose the `getblock` RPC to untrusted input, directly or indirectly. `getblock` is one of the methods lightwalletd forwards...
You are affected if you run an affected version and expose the `getblock` RPC to untrusted input, directly or indirectly. `getblock` is one of the methods lightwalletd forwards...
🚨 CVE-2026-104429
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
🎖@cveNotify
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
🎖@cveNotify
GitHub
Direct P2P tx messages bypass per-peer mempool admission accounting
## Am I affected?
You are affected if all of these hold:
- You run an affected zebrad version (>= 5.0.0, before 6.0.0-rc.0).
- Your node accepts inbound P2P connections.
- Your node is clo...
You are affected if all of these hold:
- You run an affected zebrad version (>= 5.0.0, before 6.0.0-rc.0).
- Your node accepts inbound P2P connections.
- Your node is clo...