Cyber Security Daily Radar

#go

共收录 737 条相关情报。

← 返回所有主题
安全公告2026-09-04 发布INFO

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

CVE-2026-73842

### Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-269#cwe-306#cwe-862#severity:critical
安全公告2026-09-04 发布INFO

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE-2026-72792

**CVE:** This vulnerability corresponds to [CVE-2026-72792](https://nvd.nist.gov/vuln/detail/CVE-2026-72792). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-863#severity:medium
安全公告2026-09-04 发布INFO

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key a...

CVE-2026-72793

**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-522#severity:high
安全公告2026-09-04 发布INFO

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

CVE-2026-72795

**CVE:** This vulnerability corresponds to [CVE-2026-72795](https://nvd.nist.gov/vuln/detail/CVE-2026-72795). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:high
安全公告2026-09-04 发布INFO

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE-2026-72794

**CVE:** This vulnerability corresponds to [CVE-2026-72794](https://nvd.nist.gov/vuln/detail/CVE-2026-72794). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-522#severity:high
安全公告2026-09-04 发布INFO

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

CVE-2026-72796

**CVE:** This vulnerability corresponds to [CVE-2026-72796](https://nvd.nist.gov/vuln/detail/CVE-2026-72796). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-04 发布INFO

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE-2026-72797

**CVE:** This vulnerability corresponds to [CVE-2026-72797](https://nvd.nist.gov/vuln/detail/CVE-2026-72797). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-04 发布INFO

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE-2026-72798

**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:high
安全公告2026-09-04 发布INFO

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

CVE-2026-72799

**CVE:** This vulnerability corresponds to [CVE-2026-72799](https://nvd.nist.gov/vuln/detail/CVE-2026-72799). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

CVE-2026-72800

**CVE:** This vulnerability corresponds to [CVE-2026-72800](https://nvd.nist.gov/vuln/detail/CVE-2026-72800). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

CVE-2026-72801

**CVE:** This vulnerability corresponds to [CVE-2026-72801](https://nvd.nist.gov/vuln/detail/CVE-2026-72801). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-522#severity:high
安全公告2026-09-03 发布INFO

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

CVE-2026-72802

**CVE:** This vulnerability corresponds to [CVE-2026-72802](https://nvd.nist.gov/vuln/detail/CVE-2026-72802). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-639#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

CVE-2026-72803

**CVE:** This vulnerability corresponds to [CVE-2026-72803](https://nvd.nist.gov/vuln/detail/CVE-2026-72803). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE-2026-72804

**CVE:** This vulnerability corresponds to [CVE-2026-72804](https://nvd.nist.gov/vuln/detail/CVE-2026-72804). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-200#cwe-862#severity:high
安全公告2026-09-03 发布INFO

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

CVE-2026-72805

**CVE:** This vulnerability corresponds to [CVE-2026-72805](https://nvd.nist.gov/vuln/detail/CVE-2026-72805). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

CVE-2026-72806

**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

CVE-2026-72807

**CVE:** This vulnerability corresponds to [CVE-2026-72807](https://nvd.nist.gov/vuln/detail/CVE-2026-72807). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-89#cwe-1336#severity:high
安全公告2026-09-03 发布INFO

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE-2026-72808

**CVE:** This vulnerability corresponds to [CVE-2026-72808](https://nvd.nist.gov/vuln/detail/CVE-2026-72808). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-09-03 发布INFO

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE-2026-72809

**CVE:** This vulnerability corresponds to [CVE-2026-72809](https://nvd.nist.gov/vuln/detail/CVE-2026-72809). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-290#severity:high
安全公告2026-09-03 发布INFO

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

CVE-2026-72810

**CVE:** This vulnerability corresponds to [CVE-2026-72810](https://nvd.nist.gov/vuln/detail/CVE-2026-72810). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:high