SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

CVE-2026-54069

## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdm

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

CVE-2026-54068

### Summary The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel route

历史摘要 · 未重新核验 · GitHub Advisory

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

CVE-2026-54063

## Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) ### Summary The `checkSheet()` functio

历史摘要 · 未重新核验 · GitHub Advisory

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

CVE-2026-54072

## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `r

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

CVE-2026-54067

### Summary A CSS snippet body containing `` breaks out of its surrounding `` tag when `renderSnippet()` interpolates i

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

CVE-2026-54066

## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but

历史摘要 · 未重新核验 · GitHub Advisory

GoBGP confederation validation panics on empty AS_PATH attribute

CVE-2026-49838

Found through variant analysis based on `CVE-2026-41643` ## Summary GoBGP accepts a zero-length AS_PATH during UPDATE d

历史摘要 · 未重新核验 · GitHub Advisory

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

CVE-2026-49837

### Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse

历史摘要 · 未重新核验 · GitHub Advisory

sigstore-go has a multi-log threshold bypass via single compromised log

CVE-2026-49834

### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or

历史摘要 · 未重新核验 · GitHub Advisory

OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

CVE-2026-55252

### Summary The restrictions on redirect URLs in `openrun` can be bypassed by attackers, leading to open redirect attack

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

CVE-2026-53602

## Summary Two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula cert

历史摘要 · 未重新核验 · GitHub Advisory

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVE-2026-53649

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV

历史摘要 · 未重新核验 · GitHub Advisory

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

CVE-2026-52831

## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a K

历史摘要 · 未重新核验 · GitHub Advisory

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

CVE-2026-50197

### Summary `zalando/skipper`'s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Tran

历史摘要 · 未重新核验 · GitHub Advisory

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

CVE-2026-53508

## Summary From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `opena

历史摘要 · 未重新核验 · GitHub Advisory

KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping

CVE-2026-53572

### Summary `pkg/scalers/postgresql_scaler.go` builds libpq-style connection strings by concatenating `key=value` pairs

历史摘要 · 未重新核验 · GitHub Advisory

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

CVE-2026-53553

> [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File

历史摘要 · 未重新核验 · GitHub Advisory

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

CVE-2026-53552

### Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/

历史摘要 · 未重新核验 · GitHub Advisory

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

CVE-2026-53487

## Summary Authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not

历史摘要 · 未重新核验 · GitHub Advisory

netfoil: Attacker controlled data written to logs

### Summary Domain names were written to the log without first being validated to contain allowed characters. ### Impac

历史摘要 · 未重新核验 · GitHub Advisory