CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

EUVD-2026-69915

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

CVE-2026-53600: Improper Input Validation

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

PT-2026-84676

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

FreeBSD : py-strawberry-graphql -- Incorrect authorization (1ee62c05-a646-11f1-b187-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1ee62c05-a646-11f1-b187-901b0edee044 advisory. Patrick Arminio reports: PermissionExtension.resolve evaluates the return value of haspermission for...

mitaka v2.10.1

Mitaka Mitaka is a browser extension that makes your OSINT Open Source Intelligence search & scan easier. Key features: Auto IoC indicators of compromise selection with refanging. E.g. example.com to example.com, testatexample.com to [email protected], hxxp://example.com to http://example.co...

GHSA-8RR7-CVQ3-GMFH league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

Impact AttributesExtension ships with the library but must be explicitly registered on the Environment; it is not included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register AttributesExtension are not affected by this...

CVE-2026-4813: Improper Control of Generation of Code

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...

PUB-A-492425798

Bulletin has no description...

CVE-2026-79407

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename and loadmetadata in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings director...

CVE-2026-82813

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82809

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82810

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82808

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82813 BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-82813

CVE-2026-82813 affects TubeBuddy for YouTube Extension (BEN Group) up to version 5.8.4 on Chrome. The vulnerability resides in the TBGlobal.GetToken function within the file tubebuddymaster1.js , where insufficient verification of data authenticity occurs when the argument t/c/r is manipulated. A...

CVE-2026-82813 BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...