CVE Vulnerability Catalog

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.

SiYuan is affected by an information disclosure vulnerability in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents (including private or unpublished ones) modified in the same cross-document transaction, disclosing internal identifiers and cross-document relationships. Document body contents are not directly exposed.

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.

Observable response discrepancy vulnerability in Menulux Portal before version 20260903211448 allows Account Footprinting.

Plaintext storage of a password vulnerability in Menulux Portal before version 20260903211448 allows Retrieve Embedded Sensitive Data.

Menulux Portal by Menulux Software Inc. has a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects versions before 20260903211448.

Menulux Portal by Menulux Software Inc. has a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 20260903211448.

A flaw was found in libsoup where sending an HTTP/2 request body from a non-pollable input stream can lead to buffering more data than the flow-control window allows. A malicious server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is in progress, causing the client to copy the full buffer into a smaller DATA callback without bounds check, potentially aborting the process or failing the HTTP/2 session.

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

In fastify versions before 5.12.2, the case-insensitive handling of HTTP header names is implemented by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check.

The E-cab Taxi Booking Manager for WooCommerce plugin before version 2.0.5 does not validate client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed.

JetPopup plugin by Crocoblock contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Affects versions through 2.0.20.2.

A CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on REST request detection, which can be influenced by request properties like the Accept header. An attacker can craft cross-origin requests that are treated as REST traffic, bypassing CSRF protection for session-authenticated requests. The fix restricts exemptions to requests carrying a MISP API key and adds support for X-CSRF-Token header.

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation.

DreamMaker by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a user's browser via a malicious website.