These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-89265 is an authorization bypass vulnerability in MoguBlog through version 6.2, affecting the POST /pictureSort/getPictureSortByUid endpoint. This vulnerability allows authenticated back-office users without image-category permissions to retrieve restricted image-category records by supplying a category uid. The vulnerability has a medium severity and a CVSS score of 5.3. Defenders should assess [truncated]
CVE-2026-89264 is a vulnerability in MoguBlog through version 6.2, where the comment author identity is not validated in the POST /web/comment/add endpoint. This allows authenticated users to post comments attributed to any other user, including administrators, by supplying arbitrary userUid values in the request body. The vulnerability poses a risk to deployments with public commenting enabled, as attack [truncated]
CVE-2026-89263 debrief: MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. This vulnerability enables remote callers to modify the startEmailNotification flag in Redis cache for any user identifier, effectively suppressing reply notifications without authorization. D [truncated]
CVE-2026-89262 is an authorization bypass vulnerability in MoguBlog through version 6.2, affecting the comment deletion endpoint. The vulnerability allows attackers to delete arbitrary comments and their replies by manipulating request-body fields to bypass ownership checks. This issue impacts MoguBlog deployments, as attackers can exploit it to delete comments without proper authorization, potentially di [truncated]
CVE-2026-89261 is a vulnerability in MoguBlog through version 6.2, exposing Elasticsearch index management endpoints in the mogu_search service without authentication. This allows remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionalit [truncated]
CVE-2026-89260 is an XML external entity injection vulnerability in MoguBlog through version 6.2, affecting the WeChat callback handler. The vulnerability allows unauthenticated remote attackers to read arbitrary local files or trigger outbound HTTP requests by submitting malicious DOCTYPE declarations with external parameter entities. This issue is caused by the WechatRestApi.index() method passing the r [truncated]