Posts tagged

CWE-862

Aug 29, 2026 HB

Your Bot, My Inbox: CVE-2026-68929 — Unauthenticated WeChat Channel Hijack in FastGPT

Modern anti-bot systems rarely catch scrapers because a single signal lies. They catch them because the signals disagree — a Windows user agent sitting on top of an Apple GPU, a Tokyo timezone on a Texas IP, an en-US locale dialing in from Edinburgh. This article is a hands-on d…

Vulnerability Web-Security LLM CWE-862 Missing-Authorization FastGPT WeChat

Jul 26, 2026 HB

MCP as a Backdoor: CVE-2026-66012 — How a Missing Authorization Check in SiYuan's MCP Endpoint Turns Anonymous Readers into Administrators

On July 25, 2026, NIST’s National Vulnerability Database published CVE-2026-66012, a missing-authorization vulnerability in SiYuan — the privacy-first, block-level note-taking application with over 45,000 GitHub stars and a large Docker-hosted user base. NVD scores it 10.0…

Vulnerability Web-Security RCE CWE-862 MCP Missing-Authorization SiYuan

Tags

Account-Takeover Agentic-AI android Android Android-Adb Android-apktool Android-Avd Android-Studio Anti-Bot API-Security Authentication Automotive Backslash-Breakout Baseband Browser-Automation Browser-Fingerprinting Buffer-Overflow C2 Cache-Key-Collision Camoufox CAN-Bus CAPTCHA Chrome Command-Injection Container-Escape Cross-Site-Scripting Cudy CWE-121 CWE-122 CWE-125 CWE-1333 CWE-23 CWE-288 CWE-290 CWE-347 CWE-706 CWE-798 CWE-862 CWE-89 CWE-926 CWE-94 Data-Scraping Denial-of-Service Elixir Embedded-Systems Exploit FastGPT Firmware Frida Geolocation GooglePlay Hardware Heap-Overflow Hi-Browser html-sanitize-ex HTTP2 Hugging-Face Identity-Confusion Information Security Integer-Overflow IoT JNI JWT Lexer-Differential Linux Linux-Kernel llama-cpp LLaMA-Factory LLM LwM2M Machine-Learning MCP MediaTek Memory Disclosure MindsDB Missing-Authorization mitmproxy Mobile-Security MQTT Network-Analysis Networking OAuth OAuth2 OBD2 OIDC OpenID-Connect Out-of-Bounds Page-Cache Path-Traversal Penetration Testing pgAdmin PHP phpIPAM Playwright PostgreSQL Privilege-Escalation Prompt-Injection Python Race-Condition RCE ReDoS Reverse Engineering Reverse-Engineering Router Samsung-Bixby Samsung-Exynos Security Security-Research Session Hijacking SiYuan SMS Snapchat SNMP Speech-Recognition SQL-Injection SSD SSL-Pinning STIG-Manager Supply-Chain TECNO Tenda Traefik Vulnerability Web Applications Web Scraping Web-Crawling Web-Scraping Web-Security WebGPU WeChat Wi-Fi Zephyr Zero-Day