CVE-2026-69485: Use of Uninitialized Resource

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

PT-2026-87362

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description An out-of-bounds read exists that allows an authorized attacker to disclose sensitive information over a network, potentially affecting the system. Recommendations At the moment...

PT-2026-88033

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A heap-based buffer overflow occurs in the Remote Desktop Client, which could allow an unauthorized attacker to execute arbitrary code over a network. A heap-based buffer overfl...

CVE-2026-69358: Use of Uninitialized Resource

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

CVE-2026-68828: Heap-based Buffer Overflow

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-83998: Heap-based Buffer Overflow

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

The vulnerability of the Remote Desktop Client on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Remote Desktop Client on Windows operating systems relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-49996 securedrop-proxy origin limitation can be bypassed with redirects

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...

EUVD-2026-63100

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

CVE-2026-69550

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

PT-2026-78715

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description An out-of-bounds read exists in the Remote Desktop Client, which allows an unauthorized attacker to disclose information over a network. An out-of-bounds read occurs when the...

CVE-2026-69550: Buffer Over-read

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

EUVD-2026-59795

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73052

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73052 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

CVE-2026-73052

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

CVE-2026-73043: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...