{"vulnerability": "CVE-2026-66012", "sightings": [{"uuid": "64ab991c-3a21-4d06-a5ec-2f675ee685f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66012", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrhr2mcc4i2u", "content": "CVE-2026-66012 - siyuan\nSiYuan, a software platform, has a security weakness that allows unauthorized users to gain administrator access. This can happen when the software is set to allow anonymous users\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-07-25T11:26:04.363744Z"}, {"uuid": "b176ea20-8af7-4d41-8333-a56ce804542d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66012", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhsxknojc2c", "content": "\ud83d\udd34 CVE-2026-66012 - Critical (10)\n\nSiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66012/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-25T12:00:10.308982Z"}, {"uuid": "43e8823f-b870-4063-ad83-bf0b1f45e485", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-66012", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116980503434805714", "content": "CVE-2026-66012: CRITICAL flaw in siyuan-note siyuan (<3.7.2). Missing authorization on /mcp lets remote attackers read secrets & plant malicious plugins for admin takeover. Disable anonymous Publish mode & restrict /mcp access. https://radar.offseq.com/threat/cve-2026-66012-missing-authorization-in-siyuan-note-siyuan-af31715ea5b396b1 #OffSeq #CVE #Infosec", "creation_timestamp": "2026-07-25T12:00:27.600024Z"}, {"uuid": "ac96da1b-503e-4e42-a4f4-dfb0d6541f12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-66012", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrhsy4tkds2r", "content": "CRITICAL CVE-2026-66012 in siyuan-note (<3.7.2): Missing auth in /mcp lets remote attackers fully compromise admin. Disable anonymous Publish mode & monitor access until patch. https://radar.offseq.com/threat/cve-2026-66012-missing-authorization-in-siyuan-note-siyuan-af31715ea5b396b1 #OffSeq #CVE...", "creation_timestamp": "2026-07-25T12:00:29.047284Z"}]}