•35 minutes ago•CVE-2026-72804
9.2CVE-2026-72804: Authentication Bypass and Sensitive Information Exposure in SiYuan Graph Endpoints
SiYuan before version 3.7.4 contains an authentication bypass vulnerability within its graph visualization API endpoints, allowing unauthenticated remote attackers to extract sensitive node metadata and content from password-protected documents.
1 views•7 min read
•about 2 hours ago•CVE-2026-72802
6.9CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note
SiYuan Note versions prior to v3.7.4 contain an information disclosure vulnerability in the `/api/asset/resolveAssetPath` endpoint. This endpoint returns absolute backend filesystem paths unmodified to CheckAuth-only requests. Low-privileged users or unauthenticated readers under publish mode can exploit this to leak the local directory layout, operating system username, and overall host deployment structure.
1 views•6 min read
•about 3 hours ago•CVE-2026-72801
8.7CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan
An access control vulnerability in the SiYuan personal knowledge management platform before version v3.7.4 exposes notebook encryption parameters to unauthenticated remote attackers. When the platform is configured in Publish Mode, specific API endpoints fail to enforce authorization checks. This access failure leaks key-derivation materials, password verifiers, and wrapped database keys to anonymous network clients.
3 views•6 min read
•about 5 hours ago•CVE-2026-72800
5.8CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System
A security vulnerability in the SiYuan local-first personal knowledge management system allows unauthenticated remote attackers to bypass logical boundary controls in publish (read-only) mode. By interacting with endpoints that lack proper publish-access validation, an attacker can disclose the application's internal database schemas and harvest block IDs across both public and private notebooks. This metadata leakage compromises the confidentiality of restricted documents and provides foundational information for targeted extraction.
3 views•5 min read
•about 6 hours ago•CVE-2026-72803
6.9CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API
An information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.
5 views•7 min read
•about 7 hours ago•GHSA-7J72-F6WG-CXW6
8.6CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan
An authentication bypass vulnerability (classified as CWE-288) exists in the publish-mode component of SiYuan, a Go-based note-taking application. This security flaw allows unauthenticated remote attackers to bypass password-protected note boundaries by leveraging auxiliary block endpoints that fail to enforce document access checks. Attackers can exploit this issue by first harvesting document metadata via a public search endpoint and subsequently fetching full rendered document contents using vulnerable block endpoints. This technical analysis explores the root cause, exploitation methodology, and remediation path.
3 views•7 min read
•about 8 hours ago•CVE-2026-77465
7.5CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service
An uncontrolled recursion vulnerability (CWE-674) in the toml-node NPM package (published as toml) prior to version 4.2.0 allows unauthenticated remote attackers to trigger process-wide Denial of Service (DoS) crashes. By submitting TOML payloads with deep bracket or brace nesting, attackers exhaust the V8 runtime stack limit.
6 views•6 min read
•about 9 hours ago•CVE-2026-73295
5.4CVE-2026-73295: DOM-based Cross-Site Scripting (XSS) in Material for MkDocs Search Suggestions
CVE-2026-73295 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Material for MkDocs versions 7.2.0 through 9.7.6. When the optional 'search.suggest' feature is enabled, the client-side 'mountSearchSuggest' function processes user-controlled inputs from the URL 'q' parameter and writes them directly to the DOM using an unsafe innerHTML sink without sanitization.
4 views•6 min read
•about 10 hours ago•CVE-2026-71869
9.3CVE-2026-71869: Remote Code Execution in Orval via OpenAPI Default Value Template Literal Injection
CVE-2026-71869 is a critical-severity code injection vulnerability in the Orval code generator (packages: orval, @orval/core, @orval/zod) prior to version 8.21.0. This flaw allows remote attackers to execute arbitrary JavaScript code at import-time by embedding malicious payloads into the default values of OpenAPI or Swagger specifications. This report details the root cause, exploitation mechanism, and patch remediation.
8 views•7 min read
•about 11 hours ago•CVE-2026-61625
6.8CVE-2026-61625: Arbitrary File Write via Path Traversal in VictoriaMetrics vmrestore
CVE-2026-61625 is a path traversal vulnerability (CWE-22) within the `vmrestore` utility of VictoriaMetrics. When restoring database shards from a compromised or malicious backup source, the application fails to validate the paths of backup parts before creating and writing files. By injecting objects with directory traversal sequences (such as `../`) into the remote backup storage, an attacker can write arbitrary files to out-of-bounds locations on the system executing the restore operation. Depending on the process privileges, this can result in host compromise via remote code execution.
6 views•6 min read
•about 12 hours ago•CVE-2026-73846
6.5CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server
A medium-severity cache key canonicalization collision vulnerability exists in the ckan-mcp-server prior to version 0.4.112. Unescaped delimiters in key-value parameters and server URLs allow structurally distinct requests to map to the same cryptographic hash, facilitating cache poisoning and unauthorized data exposure.
7 views•7 min read
•about 13 hours ago•GHSA-99RQ-75J6-5J9F
8.7GHSA-99rq-75j6-5j9f: Stored and Reflected XSS in SiYuan via SVG Sanitizer Bypass
A stored and reflected Cross-Site Scripting (XSS) vulnerability was identified in the SiYuan kernel before version v3.7.3. The flaw occurs due to a parser differential between the backend Go-based HTML sanitizer and the browser-side XML rendering engine. Attackers can bypass the SVG sanitizer to execute arbitrary JavaScript within the context of the application's origin, leading to complete workspace compromise, data exfiltration, and full local kernel API manipulation.
4 views•5 min read