EUVD-2026-87728

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634: Missing Authorization

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-85107

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

EUVD-2026-70454

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107

A vulnerability in NousResearch hermes-agent 0.18.0 affects the resourceBufferFromUrl function in apps/desktop/electron/main.ts (Electron Main Process), allowing a remote attacker with user interaction to trigger uncontrolled resource allocation, resulting in low availability impact. Notably, the...

PT-2026-85025

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107: Allocation of Resources Without Limits or Throttling

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70611 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70611 Source advisory: GHSA-F2R8-JV7C-XQMP...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70610 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70610 Source advisory: GHSA-FF2P-HMQR-HXM4...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70610 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70610 Source advisory: MEND:CVE-2026-70610...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +5 more potentially affected by CVE-2026-70609 via electron (>=41.0.3, <=41.1.1)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70609 Source advisory: GHSA-4F78-QHMW-8J8M...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70607 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70607 Source advisory: MEND:CVE-2026-70607...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70604 via electron (>=41.0.3, <=41.3.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70604 Source advisory: MEND:CVE-2026-70604...

@xwiki/cristal-electron-main (>=1.3.0, <=1.5.0), cicy-desktop (>=2.1.30, <=2.1.367) +2 more potentially affected by CVE-2026-70603 via electron (>=41.0.3, <=41.1.0)

electron NPM version =41.0.3, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70603 Source advisory: GHSA-5C9J-MHMV-5XGX...

@xwiki/cristal-electron-main (>=1.3.0, <=1.5.0), cicy-desktop (>=2.1.30, <=2.1.367) +2 more potentially affected by CVE-2026-70603 via electron (>=41.0.3, <=41.1.0)

electron NPM version =41.0.3, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70603 Source advisory: SNYK:JS-ELECTRON-18563328...

@xwiki/cristal-electron-main (>=1.3.0, <=1.5.0), cicy-desktop (>=2.1.30, <=2.1.367) +2 more potentially affected by CVE-2026-70603 via electron (>=41.0.3, <=41.1.0)

electron NPM version =41.0.3, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70603 Source advisory: MEND:CVE-2026-70603...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70601 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70601 Source advisory: GHSA-H7RP-CF8H-J98X...