SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
CVE-2026-72802
**CVE:** This vulnerability corresponds to [CVE-2026-72802](https://nvd.nist.gov/vuln/detail/CVE-2026-72802). ### Summa
#advisory
共收录 23717 条相关情报。
← 返回所有主题SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents
CVE-2026-72803
**CVE:** This vulnerability corresponds to [CVE-2026-72803](https://nvd.nist.gov/vuln/detail/CVE-2026-72803). ### Summa
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
CVE-2026-72804
**CVE:** This vulnerability corresponds to [CVE-2026-72804](https://nvd.nist.gov/vuln/detail/CVE-2026-72804). ### Summa
SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents
CVE-2026-72805
**CVE:** This vulnerability corresponds to [CVE-2026-72805](https://nvd.nist.gov/vuln/detail/CVE-2026-72805). ### Summa
SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)
CVE-2026-72806
**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806). ### Summa
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
CVE-2026-72807
**CVE:** This vulnerability corresponds to [CVE-2026-72807](https://nvd.nist.gov/vuln/detail/CVE-2026-72807). ### Summa
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
CVE-2026-72808
**CVE:** This vulnerability corresponds to [CVE-2026-72808](https://nvd.nist.gov/vuln/detail/CVE-2026-72808). ### Summa
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy
CVE-2026-72809
**CVE:** This vulnerability corresponds to [CVE-2026-72809](https://nvd.nist.gov/vuln/detail/CVE-2026-72809). ### Summa
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)
CVE-2026-72810
**CVE:** This vulnerability corresponds to [CVE-2026-72810](https://nvd.nist.gov/vuln/detail/CVE-2026-72810). ### Summa
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) brea...
CVE-2026-72811
**CVE:** This vulnerability corresponds to [CVE-2026-72811](https://nvd.nist.gov/vuln/detail/CVE-2026-72811). ### Summa
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)
CVE-2026-72812
**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812). ### Summa
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a...
CVE-2026-85050
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an...
CVE-2026-85222
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker...
CVE-2026-85051
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary cod
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject...
CVE-2026-9736
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The...
CVE-2026-85208
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the fun
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without...
CVE-2026-9745
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket owners
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is...
CVE-2026-85207
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of t
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
CVE-2026-85458
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a...
CVE-2026-85053
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute