CVE-2026-73052

CVE-2026-73052 concerns SiYuan before v3.7.4. The issue arises because attribute-view field names are stored without HTML escaping and are interpolated into option elements via innerHTML in the sort menu. This allows stored XSS: an attacker can rename a database field to inject markup, which can ...

CVE-2026-73052 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

CVE-2026-73052

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

CVE-2026-73050

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050

CVE-2026-73050 affects SiYuan before v3.7.4, where the color field in attribute-view select options is not validated/escaped, allowing stored XSS via eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, enabling arbitrary Jav...

CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73041

SiYuan is affected: versions before 3.7.4 fail to validate/escape annotation fields written to disk via the setFileAnnotation endpoint, allowing attackers to inject markup that can execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF. The CVE-2026-7304...

AZL-96564 CVE-2026-74564 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

UBUNTU-CVE-2026-74472

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-74485

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...

CVE-2026-74564 netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

EUVD-2026-59629

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

EUVD-2026-59665

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-74472 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-74472

CVE-2026-74472 affects the Linux kernel ublk path. The vulnerability arises because ublk_ctrl_add_dev() memcpy()s userspace dev_info into ub->dev_info but does not reset two driver-owned fields: ->state and ->ublksrv_pid. This can cause a device added with state LIVE to pass a test for “...

AZL-96441 CVE-2026-74314 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74346

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

UBUNTU-CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...