Security advisories

high2026-10-05

CVE-2026-7700-Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

View chart →

langflow-ai/langflow · GHSA-9fpm-3445-2vx4

medium2026-10-05

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

View chart →

siyuan-note/siyuan · GHSA-4wwp-f6gw-6qm5

medium2026-10-05

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

View chart →

siyuan-note/siyuan · GHSA-3cm4-ccvw-6xr6

medium2026-10-05

CVE-2026-103918-@orpc/zod: Prototype injection in smart coercion

View chart →

middleapi/orpc · GHSA-gcgf-fh7c-8gf2

critical2026-10-02

CVE-2026-73802-gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

View chart →

go-gitea/gitea · GHSA-x4q3-gcj3-m6cf

high2026-10-02

CVE-2026-104861-probe-image-size: Quadratic-time Denial of Service in the SVG Parser

View chart →

nodeca/probe-image-size · GHSA-gjj5-9665-rwrc

high2026-10-02

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

View chart →

siyuan-note/siyuan · GHSA-x8gv-g2g3-65fj

medium2026-10-02

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

View chart →

siyuan-note/siyuan · GHSA-p23f-cm6q-2qp8

high2026-10-02

CVE-2026-19481-@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

View chart →

fastify/busboy · GHSA-x8mw-p69m-v3mx

high2026-10-02

CVE-2026-19484-@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

View chart →

fastify/busboy · GHSA-xjh9-v7x6-24jw

medium2026-10-02

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

View chart →

sparklemotion/sqlite3-ruby · GHSA-mwm8-39rw-8826

high2026-10-02

Praxis affected by HTTP/2 Bomb

View chart →

praxis-proxy/praxis · GHSA-cjcg-cxmh-9wcr

high2026-10-02

CVE-2026-71416-Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

View chart →

headroomlabs-ai/headroom · GHSA-h46j-26q3-rggf

high2026-10-02

CVE-2026-74904-SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

View chart →

siyuan-note/siyuan · GHSA-4vpg-gwqq-w44c

critical2026-10-02

CVE-2026-10032-@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

View chart →

a2ui-project/a2ui · GHSA-72qq-p3r5-f7wq

low2026-10-02

CVE-2026-74802-SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

View chart →

siyuan-note/siyuan · GHSA-3cc2-h3v6-rqpq

low2026-10-02

CVE-2026-104855-Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

View chart →

bytecodealliance/wasmtime · GHSA-2hw9-mc66-jc2q

medium2026-10-02

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

View chart →

triggerdotdev/trigger.dev · GHSA-fj2x-mqqp-3v2w

high2026-10-02

CVE-2026-18140-aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

View chart →

smithy-lang/smithy-rs · GHSA-8ffr-xgwf-xj56

critical2026-10-02

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

View chart →

hkuds/vibe-trading · GHSA-v2f8-6655-7grj