CVE-2026-19734 is a vulnerability in Roskus Prospero Flow CRM before version 5.4.7 involving missing authorization checks in the product management component. Authenticated users from any company can read sensitive product data of other companies and hijack products by reassigning their company_id due to improper access control. This occurs because the ProductUpdateController lacks proper authentication enforcement and the product save operation does not restrict queries to the authenticated user's company.
CVE-2026-66441 is a high severity vulnerability involving unauthenticated broken access control in MultiVendorX versions up to and including 5.0.10. This flaw allows an attacker without authentication to bypass access restrictions, potentially leading to unauthorized access to sensitive data. The vulnerability has a CVSS score of 7.5, indicating a significant impact on confidentiality. There is no information provided about available patches or fixes for this issue. No known exploits are reported in the wild at this time.
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders.
Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.
CVE-2026-73142 is a medium severity vulnerability in Svxlink affecting multiple specific versions. It involves a connection object leak in the remotetrx NetUplink component that can lead to a denial of service (DoS). No CVSS score or detailed technical data is provided. There is no indication of known exploits in the wild or vendor patch information.
CVE-2026-73149 is an out-of-bounds read vulnerability in Svxlink's NetRx component caused by unvalidated MsgAudio length. This flaw can lead to reading memory beyond intended bounds, potentially causing application instability or information disclosure. Multiple specific Svxlink versions are affected. No CVSS score is provided, but the impact is assessed as medium severity. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.
CVE-2026-73151 is a medium severity vulnerability in Svxlink involving unvalidated audio length and exposed transceiver control in the remotetrx component. It affects multiple specific versions of Svxlink. No CVSS score or detailed technical exploit information is provided. There is no indication of known exploits in the wild or available patches.
**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793).
### Summary
`/api/system/getConf` is registered with `CheckAuth` only and is reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is `false`. Its non-administrator masking chain is a blocklist that enumerates fields individually. Three fields that the configuration-export endpoint in the same file deliberately clears are absent from that blocklist and are returned to readers:
| Field | JSON | What it is | Cleared by `exportConf` at |
|---|---|---|---|
| `Conf.CookieKey` | `cookieKey` | The session-cookie signing key | `kernel/api/system.go:360` |
| `Conf.Export.PandocBin` | `export.pandocBin` | Absolute path embedding the OS username | `kernel/api/system.go:338` |
| `Conf.NotebookCrypto` | `notebookCrypto` | Encrypted-notebook key material | `kernel/api/system.go:360` |
The project has already classified all three as values that must not leave the server. The reader-facing path returns them.
### Details
**Route.** `kernel/api/router.go:70` : `POST /api/system/getConf` → `model.CheckAuth` → `getConf`. No `CheckReadonly`, no `CheckAdminRole`.
**The masking chain, and what each stage covers.** `getConf` masks through `GetMaskedConf()` → `HideConfSecret()` (non-administrators) → `FilterConfByPublishIgnore()` (readers) → a browser-request path strip.
- `GetMaskedConf`: `UserData`, `MCPOAuth`, `AccessAuthCode`.
- `HideConfSecret`: `AI`, `Api`, `Flashcard`, `ServerAddrs`, `Publish`, `Repo`, `Sync`, `Secrets`, `Variables`, and the System paths. No reference to `CookieKey` or `Export.PandocBin`.
- `FilterConfByPublishIgnore`: `UILayout` only.
- Browser strip (`kernel/api/system.go:630-631`): System paths only.
Each stage names fields explicitly, so any field nobody thought to add is returned by default.
---
**1. `CookieKey`: the live session-signing key.**
The value is passed straight into the session store at startup:
```
cli/cmd/serve.go:67 go server.Serve(false, model.Conf.CookieKey)
kernel/server/serve.go:152 sessionStore = cookie.NewStore([]byte(cookieKey))
kernel/server/serve.go:159 ginServer.Use(sessions.Sessions("siyuan", sessionStore))
```
`gin-contrib/sessions/cookie.NewStore` constructed with a single key uses that key as the `gorilla/securecookie` HMAC key. The `siyuan` session cookie is signed with the value this endpoint hands out, so an attacker holding it can mint and modify session cookies the server accepts as authentic.
Escalating a forged session to administrator additionally requires the forged `SessionData` to carry the matching `AccessAuthCode` which *is* masked or the instance to have no access-auth code configured, which is a common deployment. The unconditional impact, present on every instance, is disclosure of a persistent cryptographic secret to an unauthenticated party. Rotating it invalidates every active session, so it cannot be quietly refreshed.
---
**2. `Export.PandocBin`: bypasses a shipped privacy control.**
The field is an absolute path that embeds the OS username by construction:
```
conf/export.go:35 PandocBin string `json:"pandocBin"`
model/conf.go:430-431 if "" == Conf.Export.PandocBin { Conf.Export.PandocBin = util.PandocBinPath }
util/pandoc.go:154 PandocBinPath = filepath.Join(tempPandocDir, "bin", "pandoc.exe")
util/pandoc.go:134 tempPandocDir = filepath.Join(TempDir, "pandoc")
util/working.go:359 TempDir = filepath.Join(WorkspaceDir, "temp")
util/working.go:312 defaultWorkspaceDir = filepath.Join(userProfile, "SiYuan")
```
→ `C:\Users\<username>\SiYuan\temp\pandoc\bin\pandoc.exe`
This one is notable beyond the disclosure itself, because a control was shipped specifically to prevent it. `kernel/api/system.go:630` adds, for browser requests:
```go
if util.IsBrowserRequest(c) {
maskedConf.System.WorkspaceDir = ""
maskedConf.System.AppDir = ""
maskedConf.System.ConfDir = ""
maskedConf.System.DataDir = ""
maskedConf.System.HomeDir = ""
} // 避免泄露用户名等敏感信息
```
The comment states the goal plainly: avoid leaking the username and other sensitive information. The block enumerates only `System.*` and misses `Export.PandocBin`, which carries the same username through the same response. A publish reader is a browser request, so the System paths are blanked while `export.pandocBin` passes through intact. Where an administrator has configured a custom pandoc location, that path is disclosed instead still a filesystem-layout disclosure.
---
**3. `NotebookCrypto`.** Encrypted-notebook key material is likewise absent from `HideConfSecret` while `exportConf` sets it to `nil`. Reported previously and included here only because it is the third instance of the same root cause; the fix below closes all three together.
---
**The root cause is the blocklist itself.** `exportConf` (`kernel/api/system.go:299`) clones the configuration and clears each secret before
phpMyFAQ version 4.2.0-alpha contains an authenticated SQL LIKE wildcard injection vulnerability in its chat user search API. This flaw allows any logged-in user to inject SQL LIKE wildcards (%) and (_) into search queries, bypassing intended display-name filtering and enabling enumeration of active user IDs and display names. The vulnerability is due to improper escaping of SQL LIKE metacharacters. A patch is available to address this issue. The vulnerability has a medium severity with a CVSS score of 5.4.
The hunt_delete() VQL function allows deleting hunts.
Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").
A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.
CivetWeb contains a heap and stack buffer overflow vulnerability in the read_websocket() function that can be triggered by unauthenticated remote attackers. This occurs when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined, allowing crafted compressed WebSocket frames with the RSV1 bit set to cause out-of-bounds writes. The vulnerability can lead to heap metadata corruption, denial of service, or potential code execution.
A vulnerability in MongoDB Server's geospatial query processing allows an authenticated user with write privileges to store malformed geometry data without proper validation. Subsequent queries on this data may cause the server to access memory outside its intended bounds, potentially leading to a denial of service via server crash and limited exposure of server process memory.
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
OpenCart version 4.2.0.0 contains a directory traversal vulnerability in its extension installer. The installer extracts uploaded .zip extension files without validating that extracted paths remain within the intended directory. This allows an attacker who can upload a malicious extension to write files outside the intended directory, such as placing a PHP web shell in the webroot. Exploitation requires valid administrator credentials to install the malicious extension. No patch is currently available, and users are advised to avoid installing untrusted extensions and to run OpenCart with minimal privileges.
CVE-2026-68409 is a high-severity use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem. It involves improper freeing of a removed MLO link's RX stats percpu buffer before ensuring all readers have finished accessing it, leading to potential memory corruption. The flaw arises because the RX stats buffer is freed immediately, while the container is deferred to RCU, causing a race condition. This vulnerability has been resolved by deferring the free of the link and its data together via a single RCU callback to ensure safe reclamation.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.