PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a...

CVE-2026-105050

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive

历史摘要 · 未重新核验 · GitHub Advisory

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

CVE-2026-73802

### Summary act_runner appends workflow-controlled `jobs..container.options` directly to the Docker HostConfig for the

历史摘要 · 未重新核验 · GitHub Advisory

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

CVE-2026-104861

## Overview `probe-image-size` scans the SVG header with a searching regular expression, `/]*>/`. On input that contain

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

# Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of `CheckHostSSRF`) | Field | Value | |-

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

# Security Advisory — SiYuan MCP `asset.upload` Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) | Field

历史摘要 · 未重新核验 · GitHub Advisory

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

CVE-2026-19481

### Impact Versions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multi

历史摘要 · 未重新核验 · GitHub Advisory

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

CVE-2026-19484

### Impact Versions of `@fastify/busboy` from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendo

历史摘要 · 未重新核验 · GitHub Advisory

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an

历史摘要 · 未重新核验 · GitHub Advisory

Praxis affected by HTTP/2 Bomb

### Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have

历史摘要 · 未重新核验 · GitHub Advisory

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

CVE-2026-71416

### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests be

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

CVE-2026-74904

Same CWE-862 family, found via an automated bulk sweep of every `/api/block/*` handler in `kernel/api/block.go` for the

历史摘要 · 未重新核验 · GitHub Advisory

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

CVE-2026-10032

### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` witho

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

CVE-2026-74802

**High** ## Package gomod `github.com/siyuan-note/siyuan/kernel` ## Affected versions 3.7.3 ## Patched versions *(non

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

CVE-2026-104855

### Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 (4.5.6 was advertised by the CLI but was not tested). A staging dry-run executed wi

历史摘要 · 未重新核验 · GitHub Advisory

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

CVE-2026-18140

### Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smith

历史摘要 · 未重新核验 · GitHub Advisory

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi

历史摘要 · 未重新核验 · GitHub Advisory

Vibe-Trading file-read tools expose arbitrary server-readable files

### Summary: 2 findings — `safe_user_path()` accepts any path under `Path.home()` or `Path.cwd()`, which inside the shi

历史摘要 · 未重新核验 · GitHub Advisory

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev: Cross-environment deployment cancel

### Summary Trigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `pre

历史摘要 · 未重新核验 · GitHub Advisory