🚨 CVE-2026-104436
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.
🎖@cveNotify
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.
🎖@cveNotify
GitHub
getblocks/getheaders locator CPU amplification via uncapped vector length
### Am I affected
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your node accepts inbound P2P connections.
### Summary
The `read_getblocks` and `read_gethea...
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your node accepts inbound P2P connections.
### Summary
The `read_getblocks` and `read_gethea...
🚨 CVE-2026-104437
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
🎖@cveNotify
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
🎖@cveNotify
GitHub
Zebra Transparent SIGHASH_SINGLE Corresponding-Output Handling Diverges From zcashd
# `Zebra` Transparent `SIGHASH_SINGLE` Corresponding-Output Handling Diverges From `zcashd`
### Summary
For V5+ transparent spends, `Zebra` and `zcashd` disagree on the same consensus rule: `SI...
### Summary
For V5+ transparent spends, `Zebra` and `zcashd` disagree on the same consensus rule: `SI...
🚨 CVE-2026-104438
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
🎖@cveNotify
GitHub
Tags actions disclose names of ACL-restricted pages
### Summary
The tags actions `{{listpagestag}}` and `{{includepages}}` enumerate pages by tag or by name
without applying read-ACL filtering, exposing the existence, names, and titles of pages tha...
The tags actions `{{listpagestag}}` and `{{includepages}}` enumerate pages by tag or by name
without applying read-ACL filtering, exposing the existence, names, and titles of pages tha...
🚨 CVE-2026-104439
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
🎖@cveNotify
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
🎖@cveNotify
GitHub
User enumeration via the lost-password flow
### Summary
The password-recovery page answers differently depending on whether the submitted email
belongs to an existing account, letting any unauthenticated attacker confirm which email
address...
The password-recovery page answers differently depending on whether the submitted email
belongs to an existing account, letting any unauthenticated attacker confirm which email
address...
🚨 CVE-2026-104440
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.
🎖@cveNotify
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.
🎖@cveNotify
GitHub
Unauthenticated blind Server-Side Request Forgery in the public Bazar API via idtypeannonce
### Summary
The public API route `GET /api/entries/bazarlist` accepts an attacker-controlled URL in the
`idtypeannonce` parameter and fetches it server-side with no scheme, host, or IP
validation,...
The public API route `GET /api/entries/bazarlist` accepts an attacker-controlled URL in the
`idtypeannonce` parameter and fetches it server-side with no scheme, host, or IP
validation,...
🚨 CVE-2026-104441
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with partial read-back via the {{valeur}} action
### Summary
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
🚨 CVE-2026-104442
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with response read-back via the {{syndication}} action
### Summary
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
🚨 CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
GitHub
Arbitrary semantic-triple delete/create by any authenticated user via empty-filter scope bypass (admin-group lockout)
## Summary
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
🚨 CVE-2026-104444
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
GitHub
Comments API editComment authorization keyed to attacker-supplied pagetag enables arbitrary page/comment overwrite
## Summary
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
🚨 CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
GitHub
ActivityPub inbox does not bind the verified signer to the activity actor, allowing cross-actor delete and update
## Summary
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
🚨 CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
GitHub
CSRF: arbitrary installed-package/extension deletion via GET in autoupdate UpdateAction
## Summary
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
🚨 CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
GitHub
CSRF arbitrary page deletion via GET in ajaxdeletepage handler
## Summary
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
🚨 CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
GitHub
Unauthenticated arbitrary page overwrite via Bazar entry creation with attacker-controlled id_fiche
## Summary
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
🚨 CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
GitHub
Unauthenticated ACL-bypassing arbitrary page write and stored XSS via pointimage action
## Summary
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
🚨 CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
GitHub
CSRF: page-revision restore (content overwrite) via GET in RevisionsHandler
## Summary
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
🚨 CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
GitHub
CSRF: page attachment deletion/purge via GET in filemanager handler
## Summary
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
🚨 CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
GitHub
CSRF: bulk tag-triple deletion via GET in admintag action
## Summary
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
🚨 CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
GitHub
Unauthenticated CPU-exhaustion DoS via O(n^2) regex in core wiki formatter (edit-preview)
## Summary
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
🚨 CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
GitHub
Unauthenticated read-ACL bypass leaks page body excerpts via recentchangesrssplus RSS
## Summary
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
🚨 CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
GitHub
Second-order SQL injection in AclService::updateRequestWithACL via unescaped username in read-ACL LIKE clause
## Summary
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
🚨 CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
GitHub
SQL injection in filtertags action via unescaped filterN parameter (backslash-escape breakout)
## Summary
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...