SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) brea...

CVE-2026-72811

**CVE:** This vulnerability corresponds to [CVE-2026-72811](https://nvd.nist.gov/vuln/detail/CVE-2026-72811). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

CVE-2026-72812

**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

**CVE:** This vulnerability corresponds to [CVE-2026-68584](https://nvd.nist.gov/vuln/detail/CVE-2026-68584). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

CVE-2026-68585

**CVE:** This vulnerability corresponds to [CVE-2026-68585](https://nvd.nist.gov/vuln/detail/CVE-2026-68585). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints ar...

CVE-2026-68586

**CVE:** This vulnerability corresponds to [CVE-2026-68586](https://nvd.nist.gov/vuln/detail/CVE-2026-68586). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

CVE-2026-68587

**CVE:** This vulnerability corresponds to [CVE-2026-68587](https://nvd.nist.gov/vuln/detail/CVE-2026-68587). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on ...

CVE-2026-69083

**CVE:** This vulnerability corresponds to [CVE-2026-69083](https://nvd.nist.gov/vuln/detail/CVE-2026-69083). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE-2026-69086

**CVE:** This vulnerability corresponds to [CVE-2026-69086](https://nvd.nist.gov/vuln/detail/CVE-2026-69086). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

CVE-2026-69084

**CVE:** This vulnerability corresponds to [CVE-2026-69084](https://nvd.nist.gov/vuln/detail/CVE-2026-69084). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

CVE-2026-79921

**Summary** A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can for

历史摘要 · 未重新核验 · GitHub Advisory

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

CVE-2026-73667

### Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlle

历史摘要 · 未重新核验 · GitHub Advisory

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

CVE-2026-73840

## Summary The OpenChoreo autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) selected the git provider used to

历史摘要 · 未重新核验 · GitHub Advisory

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

CVE-2026-73841

### Summary The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against

历史摘要 · 未重新核验 · GitHub Advisory

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

CVE-2026-73843

### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same networ

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

CVE-2026-67445

## Summary Mailpit's SMTP server reads each command line with an unbounded `bufio.Reader.ReadString('\n')` before parsi

历史摘要 · 未重新核验 · GitHub Advisory

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

CVE-2026-72921

### Impact When a filer JWT restricts a token to a set of path prefixes via `allowed_prefixes`, the authorization check

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

CVE-2026-67446

## Summary Mailpit's thumbnail endpoint decodes attacker-supplied image attachments into a full raster before checking

历史摘要 · 未重新核验 · GitHub Advisory

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

CVE-2026-84304

### Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into mi

历史摘要 · 未重新核验 · GitHub Advisory

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

CVE-2026-55785

### Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers inste

历史摘要 · 未重新核验 · GitHub Advisory

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

CVE-2026-55784

### Summary The AUSF component of free5GC stores per-subscriber authentication state in a global `sync.Map` keyed only

历史摘要 · 未重新核验 · GitHub Advisory