CVE-2026-116166
6.8 MEDIUMpublic exploit availablePublished 2026-10-25 · Updated 2026-10-25
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-319
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-36421
- MEDIUMCVE-2026-100635PoC
- LOWCVE-2026-101057PoC
- MEDIUMCVE-2026-102670
- HIGHCVE-2026-103098
- HIGHCVE-2026-104704
- LOWCVE-2026-105245PoC
- LOWCVE-2026-105766PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.