{"vulnerability": "cve-2026-7490", "sightings": [{"uuid": "e4614a61-b844-4404-aae6-956898c0dc9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7490", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10895-25ca1-2.html", "content": "", "creation_timestamp": "2026-04-30T02:20:00.000000Z"}, {"uuid": "f64ccb56-1eec-487b-bc02-8c3fe2770ace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74902", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mted6k6gqq2m", "content": "CVE-2026-74902 - siyuan\nSiYuan versions before 3.7.4 are affected by a security issue that allows attackers to upload files that can execute malicious code when a user interacts with them in the editor.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-18T13:30:07.952368Z"}, {"uuid": "d5b14059-65a5-4e45-bcfc-b26e6b4bf493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74902", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtefawmtjc2t", "content": "\ud83d\udea8 CVE-2026-74902 \u2014 CVSS 9.3 CRITICAL\n\nSiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74902\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T14:07:15.670512Z"}, {"uuid": "8d18d765-4160-4732-b227-1cdcc48d8a8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74900", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtbociaww725", "content": "\ud83d\udea8 CVE-2026-74900 \u2014 CVSS 9.3 CRITICAL\n\nopenssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation fa...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74900\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-17T12:11:12.167465Z"}, {"uuid": "a3db0bfc-29d9-4f0f-9025-68be4fd4f311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74901", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtbocqolvy2f", "content": "\ud83d\udea8 CVE-2026-74901 \u2014 CVSS 9.3 CRITICAL\n\nopenssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GC...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74901\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-17T12:11:21.161169Z"}, {"uuid": "c4041286-7a82-4bc0-b7a0-836bb9eff08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74901", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i5xvfncqfarns", "content": "CVE-2026-74901 - openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback\nCVE ID : CVE-2026-74901\n \n Published : Aug. 17, 2026, 11:16 a.m. | 56\u00a0minutes ago\n \n Description : openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in p...", "creation_timestamp": "2026-08-17T12:53:59.819756Z"}, {"uuid": "b523fb29-a2f7-4de1-90fd-ceedb5ea4336", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74900", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4xbvc346d3ke4", "content": "CVE-2026-74900 - openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode\nCVE ID : CVE-2026-74900\n \n Published : Aug. 17, 2026, 11:16 a.m. | 56\u00a0minutes ago\n \n Description : openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KE...", "creation_timestamp": "2026-08-17T12:55:59.967904Z"}, {"uuid": "222dba05-c833-4b5e-ac88-adb77266be84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74900", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mtbtqn42ra2c", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-74900](https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p3gq-pcg9-q...\nhttps://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p3gq-pcg9-qvfv #PatchManagement #Vulnerability #CVE", "creation_timestamp": "2026-08-17T13:48:35.762153Z"}, {"uuid": "c23d1461-6fd9-4a56-9ecc-d21e9655e581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74901", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtcgbfrcf624", "content": "CVE-2026-74901 - openssl_encrypt\nA security issue affects old versions of a popular encryption function used in some software. This means that attackers could modify data in transit without being\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#opensslencrypt #jahlives #CVE #infosec", "creation_timestamp": "2026-08-17T19:20:05.728279Z"}, {"uuid": "2bdfddcb-c5e6-4d00-b676-ecbeab1fc95b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74900", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtcgtbtaed2t", "content": "CVE-2026-74900 - openssl_encrypt\nOld versions of OpenSSL's encryption feature can be tricked into using a weak secret. This allows attackers to decrypt data if they have a small part of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#opensslencrypt #jahlives #CVE #infosec", "creation_timestamp": "2026-08-17T19:30:06.710245Z"}, {"uuid": "ba418fb2-c287-4fb2-a901-35f2a8895671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74900", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mtqd4z63tp2n", "content": "Critical CVE landed today in OpenSSL:\n\nCVE-2026-74900. openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-74900", "creation_timestamp": "2026-08-23T08:01:13.840550Z"}, {"uuid": "9a6ab41d-cd4d-40cd-b57d-6671218785f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74901", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mtqqmvkhfl2t", "content": "Critical CVE landed today in OpenSSL:\n\nCVE-2026-74901. openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-74901", "creation_timestamp": "2026-08-23T12:02:45.362601Z"}, {"uuid": "b4fe40b0-3b9a-41b4-a617-717c0087430d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7490", "type": "seen", "source": "https://t.me/shimiscyberworld/1131", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-7490 \u2014 CVSS 7.2\nSunnet CTMS/CPAS Arbitrary File Upload Allows RCE\n\nCVE-2026-7490 \u2014 CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on\u2026\n\n\ud83d\udfe1 Medium\n\n#cve  #high_severity  #code_execution\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-7490 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:19.840744Z"}, {"uuid": "aab4e1d1-ae9c-4580-9ad2-b117c47d6606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-74907", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-4v9q-p283-qc2m", "content": "", "creation_timestamp": "2026-09-17T22:35:06.211179Z"}, {"uuid": "0c881641-cc5a-4ab2-9b0a-8f725410ce69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74907", "type": "seen", "source": "https://gist.github.com/alon710/c2299acc28e550e2d0a5db2c44f59d94", "content": "# CVE-2026-74907: CVE-2026-74907: Directory Traversal in Grav CMS Pre-Boot Static Asset Server\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74907\n\n## Summary\nAn unauthenticated directory traversal vulnerability exists in Grav CMS prior to version 2.0.15. Due to an insecure string-based containment check (str_starts_with) in the pre-boot static asset server, attackers can read files in sibling directories sharing a prefix with the configured asset path when plugin-asset-map.php is enabled.\n\n## TL;DR\nAn insecure string containment check in Grav's pre-boot asset server allows unauthenticated remote attackers to read files in sibling directories via path traversal.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00333 (Percentile: 26.56%)\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS\n- **Grav**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade the Grav core installation to version 2.0.15 or newer.\n- Manually apply the directory boundary enforcement patch to index.php.\n- Disable the static asset mapping feature by removing the plugin-asset-map.php configuration file.\n\n**Remediation Steps:**\n1. Download Grav version 2.0.15 or verify updates via the Grav administration panel.\n2. If manual patching is chosen, open index.php and update the str_starts_with statement to append a directory separator.\n3. Navigate to the user/config/ directory and verify if plugin-asset-map.php is present; delete it if asset mapping is unused.\n\n## References\n\n- [GitHub Security Advisory GHSA-4v9q-p283-qc2m](https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m)\n- [NVD Vulnerability Details for CVE-2026-74907](https://nvd.nist.gov/vuln/detail/CVE-2026-74907)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php)\n- [Official Commit Patch](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd.patch)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74907) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T02:31:49.781142Z"}, {"uuid": "bbcff34c-39d4-4e87-9964-592768e6e783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74904", "type": "seen", "source": "https://gist.github.com/alon710/47da12356e94a1dcc2ea8b033ffc5504", "content": "# CVE-2026-74904: CVE-2026-74904: Missing Authorization in SiYuan Note-Taking Application API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74904\n\n## Summary\nA high-severity missing authorization vulnerability (CWE-862) exists in the SiYuan note-taking application before v3.7.4. Seventeen block metadata and content-derived endpoints within kernel/api/block.go lack proper publish-access and role-based checks. This allows low-privilege or anonymous users in publish mode to bypass workspace restrictions and disclose private block content, trace workspace structures, map document indexes, and verify the existence of private notes. The vulnerability is addressed in version v3.7.4.\n\n## TL;DR\nUnauthenticated or anonymous users can exploit missing authorization checks in SiYuan's block APIs to retrieve private note contents and map document metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00504 (Percentile: 40.87%)\n- **Impact**: Information Disclosure\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note-Taking Application\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Disable Publish Mode entirely if upgrades cannot be performed\n- Restrict network access to port 6806 using firewall rules or a reverse proxy\n\n**Remediation Steps:**\n1. Verify the running version of SiYuan using the settings or API interface\n2. Download the latest version (v3.7.4 or later) from the official GitHub repository or update the container image\n3. Apply network access controls to ensure the backend port is not exposed directly to the public internet\n4. Configure a reverse proxy with path-based access controls to block unauthenticated requests to /api/block/*\n\n## References\n\n- [GitHub Security Advisory GHSA-4vpg-gwqq-w44c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c)\n- [Fix Commit bd067a4fe9b208c0858d8d9dc6220dc8affc403e](https://github.com/siyuan-note/siyuan/commit/bd067a4fe9b208c0858d8d9dc6220dc8affc403e)\n- [SiYuan Release v3.8.0](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n- [VulnCheck Advisory for SiYuan Note](https://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api)\n- [NVD CVE-2026-74904 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-74904)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T08:30:29.000000Z"}]}