Security Advisories

medium2026-09-08

CVE-2026-65915-NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

View chart

nltk/nltk · GHSA-72r2-7mfr-5xr9

high2026-09-08

CVE-2026-70626-NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

View chart

nltk/nltk · GHSA-r6gq-whwq-mvg9

high2026-09-04

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

View chart

microsoft/typespec · GHSA-7q9c-hpx7-9cwm

critical2026-09-04

CVE-2026-73842-OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

View chart

openchoreo/openchoreo · GHSA-rh53-xvx2-j327

medium2026-09-04

CVE-2026-73557- vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

View chart

vllm-project/vllm · GHSA-pr7f-p5mw-fc87

medium2026-09-04

CVE-2026-73556-vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

View chart

vllm-project/vllm · GHSA-48jh-3gj7-fg8v

medium2026-09-04

CVE-2026-73555-vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

View chart

vllm-project/vllm · GHSA-hwrm-c4cx-rf4j

medium2026-09-04

CVE-2026-71486-vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

View chart

vllm-project/vllm · GHSA-8737-qx52-hjff

medium2026-09-04

CVE-2026-72792-SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

View chart

siyuan-note/siyuan · GHSA-mp7r-57w4-5qm3

high2026-09-04

CVE-2026-72793-SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

View chart

siyuan-note/siyuan · GHSA-h4v5-crx2-3cv4

high2026-09-04

CVE-2026-72795-SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

View chart

siyuan-note/siyuan · GHSA-h6w7-xxcf-w2mq

high2026-09-04

CVE-2026-72794-SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

View chart

siyuan-note/siyuan · GHSA-34fj-mwm6-fjfg

medium2026-09-04

CVE-2026-72796-SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

View chart

siyuan-note/siyuan · GHSA-fgmr-7w36-9qfq

medium2026-09-04

CVE-2026-72797-SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

View chart

siyuan-note/siyuan · GHSA-f2rw-w22v-54vh

high2026-09-04

CVE-2026-72798-SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

View chart

siyuan-note/siyuan · GHSA-mfrj-v65r-979c

medium2026-09-04

CVE-2026-72799-SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

View chart

siyuan-note/siyuan · GHSA-5w7r-f4cg-rqq7

medium2026-09-04

CVE-2026-63733-SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

View chart

surrealdb/surrealdb · GHSA-66r2-5gwj-gxm2

high2026-09-04

CVE-2026-63735-SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

View chart

surrealdb/surrealdb · GHSA-848m-r628-vrxw

high2026-09-04

CVE-2026-75911-CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

View chart

hmbown/codewhale · GHSA-gx45-xrj5-g6c4

high2026-09-04

CVE-2026-75858-CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

View chart

hmbown/codewhale · GHSA-wrj3-vj8c-784f