SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
CVE-2026-103763
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met
2026-10-03 归档
今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
CVE-2026-103762
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a
Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot a
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
CVE-2026-97652
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflecte
Argument Injection leading to arbitrary process termination in gotop
CVE-2026-91784
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passe
NTRU leaks private key information by reducing secret values with a non-constant-time integer division
CVE-2026-18036
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference i
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-97641
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content i
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
CVE-2026-17508
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost paramete
MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender
CVE-2026-17507
In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index
Quadratic-time escaping when converting X.509 distinguished names to strings
CVE-2026-103604
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.Va
Unbounded HSS public key level count allows huge array allocation during signature verification
CVE-2026-103603
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legi
Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
CVE-2026-103602
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.
CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check
CVE-2026-103601
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of
Unbounded ASN.1 nesting depth causes process-terminating stack overflow
CVE-2026-103600
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-cs
Unbounded PBE iteration count when decrypting PKCS#8 private keys
CVE-2026-63578
Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters)
Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
CVE-2026-63577
Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree)
URI name constraints checked against a mis-parsed host
CVE-2026-63576
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc.
PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
CVE-2026-63575
Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy C
Unbounded allocation from OpenPGP signature and user attribute subpacket lengths
CVE-2026-63574
Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubp
Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap
CVE-2026-63573
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legio