CVE-2026-122154
purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
| CWE | CWE-200 CWE-284 |
| Vendor | purocean |
| Product | yank note |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for purocean yank note
Be the first to know when new medium vulnerabilities affecting purocean yank note are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
purocean / Yank Note
3.93.0
References
vuldb.com: https://vuldb.com/vuln/431155 vuldb.com: https://vuldb.com/vuln/431155/cti vuldb.com: https://vuldb.com/cve/CVE-2026-122154 vuldb.com: https://vuldb.com/submit/1028031 github.com: https://github.com/purocean/yn/issues/532 github.com: https://github.com/purocean/yn/pull/535 github.com: https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df github.com: https://github.com/purocean/yn/releases/tag/v3.93.1
Credits
🔍 CopperKoi (VulDB User) VulDB CNA Team