Permalink CVE-2026-73249

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  3 packages

  • calibre-web
  • calibre-no-speech
  • pkgsRocm.calibre-no-speech
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5x64-w63v-x2g6 x_refsource_CONFIRM
• https://github.com/kovidgoyal/calibre/commit/71295e8b62801e1ccecaa4fac47e6942f11cfe1e x_refsource_MISC
• https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 x_refsource_MISC

---

calibre

• ==< 9.12.0

Permalink CVE-2026-73248

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  3 packages

  • calibre-web
  • calibre-no-speech
  • pkgsRocm.calibre-no-speech
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4f7g-rjfp-hmvx x_refsource_CONFIRM
• https://github.com/kovidgoyal/calibre/commit/dac9990458374a81a5372a768bba6527d965aac8 x_refsource_MISC
• https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 x_refsource_MISC

---

calibre

• ==< 9.12.0

Permalink CVE-2026-19654

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

• https://access.redhat.com/security/cve/CVE-2026-19654 x_refsource_REDHATvdb-entry
• RHBZ#2502868 x_refsource_REDHATissue-tracking
• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29

---

rsyslog

rsyslog7

Permalink CVE-2026-19642

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

• https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 patchrelease-notes
• https://aws.amazon.com/security/security-bulletins/2026-080-aws/ vendor-advisory
• https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-wxx3-prfc-69xx release-notes

---

aws-sdk-cpp

• =<1.11.861

Permalink CVE-2026-19643

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms

• https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 patchrelease-notes
• https://aws.amazon.com/security/security-bulletins/2026-080-aws/ vendor-advisory
• https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-mxm9-xpf9-x66x release-notes

---

aws-sdk-cpp

• =<1.11.861

Permalink CVE-2026-73491

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

• https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==>= 2.25.0, < 2.25.2

Permalink CVE-2026-73490

4.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah: SVG `href` attribute bypasses local-reference restriction

• https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==< 2.25.2

Permalink CVE-2026-73492

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

• https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==>= 2.25.0, < 2.25.2

Permalink CVE-2026-73264

7.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-fhj4-q47f-w7mv x_refsource_CONFIRMexploit
• https://github.com/prowler-cloud/prowler/pull/11928 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/pull/11940 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/1c4d8e3e756ee04367353101af797004d1c0258f x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/3f2e5929d9ff3c1a5d2fae49f8edd419ee99a8e2 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.33.1 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.34.0 x_refsource_MISC

---

prowler

• ==< 5.33.1

Needs backport

Permalink CVE-2026-73263

9.9 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j x_refsource_CONFIRMexploit
• https://github.com/prowler-cloud/prowler/pull/12091 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/0b782fcb8c24ece7bd38deede2b8f13d8583e39c x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.36.0 x_refsource_MISC

---

prowler

• ==< 5.36.0

Needs backport

Permalink CVE-2026-73262

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4 x_refsource_CONFIRM
• https://github.com/prowler-cloud/prowler/pull/12221 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.37.0 x_refsource_MISC

---

prowler

• ==< 5.37.0

Permalink CVE-2026-58076

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

• https://github.com/apache/airflow/pull/68511 patch
• https://www.cve.org/CVERecord?id=CVE-2026-33264 related
• https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-54183

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

• https://github.com/apache/airflow/pull/68422 patch
• https://www.cve.org/CVERecord?id=CVE-2026-42358 related
• https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-65017

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

• https://github.com/apache/airflow/pull/70755 patch
• https://www.cve.org/CVERecord?id=CVE-2026-48828 related
• https://www.cve.org/CVERecord?id=CVE-2026-48892 related
• https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38 vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-67587

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

• https://github.com/apache/airflow/pull/70704 patch
• https://www.cve.org/CVERecord?id=CVE-2026-58076 related
• https://www.cve.org/CVERecord?id=CVE-2026-67260 related
• https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0 vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-68970

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

• https://github.com/apache/airflow/pull/70891 patch
• https://www.cve.org/CVERecord?id=CVE-2026-59244 related
• https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28 vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-68971

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

• https://github.com/apache/airflow/pull/70893 patch
• https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/12/15

---

apache-airflow

• <3.3.1

Permalink CVE-2026-68969

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

• https://github.com/apache/airflow/pull/70890 patch
• https://www.cve.org/CVERecord?id=CVE-2026-50204 related
• https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-59244

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

• https://github.com/apache/airflow/pull/68975 patch
• https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/12/7

---

apache-airflow

• <3.3.1

Permalink CVE-2026-67260

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

• https://github.com/apache/airflow/pull/70685 patch
• https://www.cve.org/CVERecord?id=CVE-2026-58076 related
• https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn vendor-advisory

---

apache-airflow

• <3.3.1

Permalink CVE-2026-59242

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

• https://github.com/apache/airflow/pull/69378 patch
• https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/12/6

---

apache-airflow

• <3.3.1

Permalink CVE-2026-68076

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

• https://github.com/apache/airflow/pull/70736 patch
• https://github.com/apache/airflow/pull/70902 patch
• https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/12/11

---

apache-airflow

• <3.3.1

Permalink CVE-2026-68968

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

• https://github.com/apache/airflow/pull/70889 patch
• https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/12/12

---

apache-airflow

• <3.3.1

Permalink CVE-2026-72790

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via getNotebookInfo

• GitHub Security Advisory (GHSA-74pj-6g7r-j55c) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getNotebookInfo third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72809

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

• GitHub Security Advisory (GHSA-3mp7-4rh5-jrv9) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Localhost Trust third-party-advisory

---

siyuan

• ==3.7.4
• <3.7.4

Permalink CVE-2026-72788

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via UILayout Filter

• GitHub Security Advisory (GHSA-hgfg-j9pg-43xw) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via UILayout Filter third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72793

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

• GitHub Security Advisory (GHSA-h4v5-crx2-3cv4) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via /api/system/getConf third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72801

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Encryption Key Material

• GitHub Security Advisory (GHSA-8x84-r2ff-h8pq) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Encryption Key Material third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72807

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 SQL Injection via queryBlocks template

• GitHub Security Advisory (GHSA-x67c-8pwr-m8g3) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 SQL Injection via queryBlocks template third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72798

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via renderAttributeView

• GitHub Security Advisory (GHSA-mfrj-v65r-979c) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via renderAttributeView third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72799

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Path Resolution

• GitHub Security Advisory (GHSA-5w7r-f4cg-rqq7) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Path Resolution third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72806

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Authentication Bypass via Attribute View

• GitHub Security Advisory (GHSA-6mcf-g667-w3qv) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Attribute View third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72804

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

• GitHub Security Advisory (GHSA-vpjw-wf5h-cgpq) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72800

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Unfiltered API

• GitHub Security Advisory (GHSA-5fhr-f75j-8wr9) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Unfiltered API third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72802

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via resolveAssetPath

• GitHub Security Advisory (GHSA-jv8v-xq2h-657v) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via resolveAssetPath third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72803

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via getBlockAttrs

• GitHub Security Advisory (GHSA-qvq9-hq6p-v378) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getBlockAttrs third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72792

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Tag API

• GitHub Security Advisory (GHSA-mp7r-57w4-5qm3) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Tag API third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72797

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

• GitHub Security Advisory (GHSA-f2rw-w22v-54vh) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72796

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Access Control Bypass via Static Routes

• GitHub Security Advisory (GHSA-fgmr-7w36-9qfq) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Access Control Bypass via Static Routes third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72791

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews

• GitHub Security Advisory (GHSA-57v5-wqx3-cgj4) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72794

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

• GitHub Security Advisory (GHSA-34fj-mwm6-fjfg) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: siyuan before v3.7.4 Session Cookie Key Disclosure via getConf third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72805

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Block Endpoints

• GitHub Security Advisory (GHSA-67x2-mq63-v9vm) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Block Endpoints third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72808

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

• GitHub Security Advisory (GHSA-v7ph-r5r6-4jcj) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getFileAnnotation third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72795

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Information Disclosure via Embed Block

• GitHub Security Advisory (GHSA-h6w7-xxcf-w2mq) exploitvendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Embed Block third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72789

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored reference VulnCheck… 1 month ago
• @LeSuisse published on GitHub 1 month ago

SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

• GitHub Security Advisory (GHSA-v684-q882-jgmq) vendor-advisory

Ignored references (1)

• VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73035

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

• Researcher Disclosure technical-description
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/npm-check-updates-terminal-injection-via-u… third-party-advisory

---

npm-check-updates

• =<23.0.2
• ==b554b84848fc0b08a9d2b3d3db15e351387168cf

Permalink CVE-2026-72718

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  4 packages

  • mongoose
  • goose
  • goose-lang
  • imapgoose
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

• https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r x_refsource_CONFIRMexploit
• https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de x_refsource_MISC
• https://github.com/aaif-goose/goose/releases/tag/v1.44.0 x_refsource_MISC

---

goose

• ==< 1.44.0