These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-89265 is an authorization bypass vulnerability in MoguBlog through version 6.2, affecting the POST /pictureSort/getPictureSortByUid endpoint. This vulnerability allows authenticated back-office users without image-category permissions to retrieve restricted image-category records by supplying a category uid. The vulnerability has a medium CVSS score of 5.3 and is considered a medium priority for [truncated]
CVE-2026-89264 is a vulnerability in MoguBlog through version 6.2, where the comment author identity is not validated in the POST /web/comment/add endpoint. This allows authenticated users to post comments attributed to any other user, including administrators, by supplying arbitrary userUid values in the request body. The vulnerability can be exploited by authenticated users to impersonate other users, i [truncated]
CVE-2026-89263 debrief: MoguBlog through 6.2 has an unauthenticated endpoint that allows disabling email notifications for arbitrary users. This vulnerability enables attackers to suppress email notifications without authorization, potentially impacting user engagement and security response. Defenders should assess exposure and implement mitigations, especially for systems using MoguBlog versions up to 6. [truncated]
CVE-2026-89262 is an authorization bypass vulnerability in MoguBlog through version 6.2, affecting the comment deletion endpoint. The vulnerability allows attackers to delete arbitrary comments and their replies by manipulating request-body fields to bypass ownership checks. This could lead to data loss if exploited. Defenders should assess exposure and verify comment deletion requests to prevent unauthor [truncated]
CVE-2026-89261 is a vulnerability in MoguBlog through version 6.2, exposing Elasticsearch index management endpoints in the mogu_search service without authentication. This allows remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionalit [truncated]
CVE-2026-89260 is an XML external entity injection vulnerability in MoguBlog through version 6.2, located in the WeChat callback handler at POST /wechat/wechatCheck. The vulnerability allows unauthenticated remote attackers to read arbitrary local files or trigger outbound HTTP requests by submitting DOCTYPE declarations with external parameter entities. Resolved entities are reflected in error responses.