Total
3969 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62313 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set `security.idmap.isolated=false` (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset `security.idmap.isolated` defaults to `false` (non-isolation), a user simply leaves the key out and obtains exactly the container state the restriction is meant to forbid. This defeats the tenant-isolation guarantee the restriction exists to provide. Containers in the project share the host uid/gid map instead of receiving unique, non-overlapping ranges, weakening the isolation boundary between co-tenant containers and the host. Version 7.3.0 patches the issue. | |||||
| CVE-2026-77134 | 2026-08-26 | N/A | N/A | ||
| The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval. | |||||
| CVE-2026-71234 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. | |||||
| CVE-2026-71247 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here. | |||||
| CVE-2026-60083 | 2026-08-26 | N/A | 4.9 MEDIUM | ||
| SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json. | |||||
| CVE-2026-73049 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents. | |||||
| CVE-2026-74906 | 2026-08-26 | N/A | 7.5 HIGH | ||
| SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints. | |||||
| CVE-2026-73059 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes. | |||||
| CVE-2026-72792 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password. | |||||
| CVE-2026-72788 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication. | |||||
| CVE-2026-58443 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| Public-only repository tokens can update private PR head branches | |||||
| CVE-2026-58427 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | |||||
| CVE-2026-55987 | 2026-08-26 | N/A | 8.1 HIGH | ||
| OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | |||||
| CVE-2026-24791 | 2026-08-26 | N/A | 8.1 HIGH | ||
| Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | |||||
| CVE-2026-58425 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | |||||
| CVE-2026-57897 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | |||||
| CVE-2026-56443 | 2026-08-26 | N/A | 9.6 CRITICAL | ||
| Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | |||||
| CVE-2026-58416 | 2026-08-26 | N/A | 7.1 HIGH | ||
| Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | |||||
| CVE-2026-58444 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | |||||
| CVE-2026-58431 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| Public-only API token restriction is not enforced on team API routes | |||||