Security Advisories

critical2026-09-03

CVE-2026-72811-SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

View chart

siyuan-note/siyuan · GHSA-q2vg-7qgx-x5fc

medium2026-09-03

CVE-2026-72812-SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

View chart

siyuan-note/siyuan · GHSA-wgwx-479j-23vq

high2026-09-03

CVE-2026-85396-rubyzip path traversal vulnerability

View chart

rubyzip/rubyzip · GHSA-47m2-wp7j-p9vc

high2026-09-03

CVE-2026-85393-node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

View chart

digitalbazaar/forge · GHSA-86w9-cpqp-85rv

critical2026-09-03

CVE-2026-85394-python-jose algorithm confusion guard bypassed by DER-encoded public keys

View chart

mpdavis/python-jose · GHSA-3qf3-8w2g-rqmx

high2026-09-03

CVE-2026-68584-SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

View chart

siyuan-note/siyuan · GHSA-7j72-f6wg-cxw6

medium2026-09-03

CVE-2026-68585-SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

View chart

siyuan-note/siyuan · GHSA-pm3w-vxp9-ccwc

high2026-09-03

CVE-2026-68586-SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

View chart

siyuan-note/siyuan · GHSA-36v8-mpjm-8j5r

high2026-09-03

CVE-2026-68587-SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

View chart

siyuan-note/siyuan · GHSA-69mh-gvh4-8gp7

critical2026-09-03

CVE-2026-69083-SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

View chart

siyuan-note/siyuan · GHSA-fph3-ghq9-vw66

high2026-09-03

CVE-2026-77465-toml-node: Uncontrolled Recursion

View chart

binarymuse/toml-node · GHSA-82x6-q7mm-w9cf

high2026-09-03

CVE-2026-63376-toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

View chart

binarymuse/toml-node · GHSA-v5mp-jgw5-2x6j

high2026-09-03

CVE-2026-69086-SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

View chart

siyuan-note/siyuan · GHSA-7hm9-v7vf-7g4w

high2026-09-03

CVE-2026-56811-Phoenix: Unbounded channel joins per transport enables DoS over few connections

View chart

phoenixframework/phoenix · GHSA-6983-jfq8-485w

medium2026-09-03

CVE-2026-56812-Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

View chart

phoenixframework/phoenix · GHSA-63mc-hw7g-86rr

medium2026-09-03

CVE-2026-71429-stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

View chart

uhop/stream-json · GHSA-528h-pc64-c93x

critical2026-09-03

CVE-2026-69084-SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

View chart

siyuan-note/siyuan · GHSA-vh22-h7hf-www7

high2026-09-03

CVE-2026-79921-amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

View chart

rabbitmq/amqp091-go · GHSA-6c5v-hqjr-5xxp

medium2026-09-03

CVE-2026-63670-ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

View chart

apostrophecms/apostrophe · GHSA-jxwj-j7wr-gfrw

medium2026-09-03

CVE-2026-63669-ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

View chart

apostrophecms/apostrophe · GHSA-wr5r-wqp2-x4fh