CVE-2026-116166

The record

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Affected packages

Related vulnerabilities

• CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because… CWE-319
• CVE-2026-115495 Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile… CWE-319
• CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability… CWE-319
• CVE-2026-116196 Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that… CWE-319
• CVE-2026-116200 Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap()… CWE-319
• CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. CWE-319
• CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may… CWE-319
• CVE-2026-92543 Docker Engine classifies a registry hostname as insecure using an any-match DNS check. CWE-319