SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

CVE-2026-50551

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (data

历史摘要 · 未重新核验 · GitHub Advisory

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

CVE-2026-54159

### Impact A PHP Object Injection vulnerability affects the PrestaShop module `ps_facetedsearch`. The module rebuilds

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

CVE-2026-54158

### Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its b

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

CVE-2026-54088

## Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an

历史摘要 · 未重新核验 · GitHub Advisory

`exploration` was removed from crates.io for malicious code

A method within the `exploration` crate attempted to download and execute a payload from a remote site. The malicious c

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Authentication Bypass via Proxy Auth Header Forgery

CVE-2026-54089

## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

CVE-2026-54069

## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdm

历史摘要 · 未重新核验 · GitHub Advisory

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

CVE-2026-54072

## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `r

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

CVE-2026-54067

### Summary A CSS snippet body containing `` breaks out of its surrounding `` tag when `renderSnippet()` interpolates i

历史摘要 · 未重新核验 · GitHub Advisory

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows...

CVE-2026-58122

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attacker

历史摘要 · 未重新核验 · GitHub Advisory

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that...

CVE-2026-58123

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attacker

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

CVE-2026-52778

### Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

CVE-2026-52777

## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $import

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

CVE-2026-52766

### Summary The `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` arr

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics...

CVE-2026-47646

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allo

历史摘要 · 未重新核验 · GitHub Advisory

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVE-2026-53649

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV

历史摘要 · 未重新核验 · GitHub Advisory

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

CVE-2026-52831

## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a K

历史摘要 · 未重新核验 · GitHub Advisory

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low...

CVE-2026-56843

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated custo

历史摘要 · 未重新核验 · GitHub Advisory

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows...

CVE-2026-59705

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t

历史摘要 · 未重新核验 · GitHub Advisory

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and...

CVE-2026-59706

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

历史摘要 · 未重新核验 · GitHub Advisory