Security advisories

critical2026-03-16

CVE-2026-32767-SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

siyuan-note/siyuan · GHSA-j7wh-x834-p3r7

critical2026-03-16

CVE-2026-32760-File Browser Signup Grants Admin When Default Permissions Include Admin

filebrowser/filebrowser · GHSA-5gg9-5g7w-hm73

medium2026-03-16

CVE-2026-56397-SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

siyuan-note/siyuan · GHSA-v3mg-9v85-fcm7

medium2026-03-16

CVE-2026-32759-File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely

filebrowser/filebrowser · GHSA-ffx7-75gc-jg7c

medium2026-03-16

CVE-2026-33572-OpenClaw session transcript files were created without forced user-only permissions

openclaw/openclaw · GHSA-vr7j-g7jv-h5mp

high2026-03-16

OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection

openclaw/openclaw · GHSA-g2f6-pwvx-r275

high2026-03-16

CVE-2026-32980-OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

openclaw/openclaw · GHSA-jq3f-vjww-8rq7

high2026-03-16

OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval

openclaw/openclaw · GHSA-63f5-hhc7-cx6p

medium2026-03-16

OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

openclaw/openclaw · GHSA-xwcj-hwhf-h378

medium2026-03-16

CVE-2026-32751-SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

siyuan-note/siyuan · GHSA-qr46-rcv3-4hq3

medium2026-03-16

CVE-2026-32750-SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes

siyuan-note/siyuan · GHSA-rjhh-m223-9qqv

high2026-03-16

CVE-2026-32749-SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write

siyuan-note/siyuan · GHSA-qvvf-q994-x79v

medium2026-03-16

CVE-2026-32815-SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

siyuan-note/siyuan · GHSA-xp2m-98x8-rpj6

medium2026-03-16

CVE-2026-32747-SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets

siyuan-note/siyuan · GHSA-h5vh-m7fg-w5h6

high2026-03-16

CVE-2026-32728-Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

parse-community/parse-server · GHSA-42ph-pf9q-cr72

high2026-03-16

CVE-2026-32268-Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

craftcms/azure-blob · GHSA-q6fm-p73f-x862

high2026-03-16

CVE-2026-32267-Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

craftcms/cms · GHSA-cc7p-2j3x-x7xf

high2026-03-16

CVE-2026-30405-GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

osrg/gobgp · GHSA-4p9m-8gc4-rw2h

low2026-03-16

CVE-2026-32266-Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

craftcms/google-cloud · GHSA-67cr-jmh8-4jpq

medium2026-03-16

CVE-2026-32265-Amazon S3 for Craft CMS has an Information Disclosure vulnerability

craftcms/aws-s3 · GHSA-hwj7-4vgc-j3v9