CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92957

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process informati...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957

vm2 (a Node.js sandboxing library) through version 3.11.6 fails to normalize node:-prefixed builtin specifiers when matching negative entries in a NodeVM wildcard require policy. Because deny-list entries are compared by exact string against canonical builtin names, a policy like ['*', '-node:chi...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

Exploit for SQL Injection in Cisco Asyncos

CVE-2026-76461 Vulnerability Exercise This project contains a...

Vulnerabilities found in Cisco Identity Services Engine (ISE)

Cisco has identified 21 vulnerabilities in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC. These vulnerabilities concern various security issues in Cisco ISE and ISE-PIC, including opportunities for unauthorized and low-privilege malicious actors to perform...

CVE-2026-92718

A flaw was found in Nuclei. An attacker can exploit a vulnerability in how Nuclei caches template signature verification. By replacing verified templates with malicious content and restoring the original modification time, an attacker can bypass signature checks, leading to the execution of...

EUVD-2026-81292

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-52483

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

CVE-2026-92985: Improper Neutralization of Input During Web Page Generation

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

PT-2026-94358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Improper escaping of bookmark labels imported from notebook files occurs during rendering in the dock tree. This allows attackers to create malicious .sy notebook files containing unescaped HTML withi...

PT-2026-98959

Name of the Vulnerable Software and Affected Versions NetworkManager-sstp affected versions not specified Description A flaw in the SSTP VPN plugin for NetworkManager allows a local unprivileged user to execute arbitrary commands with root privileges. The issue occurs when shell...

CVE-2026-92957: Improper Privilege Management

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

PT-2026-94359

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description The software renders document titles as HTML in the backlink dock tree without escaping markup characters. This allows attackers to set malicious titles via the rename API or crafted notebooks to...