CVE-2026-100646

The SiYuan personal knowledge management system (versions up to and including 3.8.3 ) is vulnerable to an authentication bypass because the kernel's authentication guards—specifically CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go—fail open when the HTTP Ori...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

EUVD-2026-87736

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

Astra Linux – Vulnerability in Chromium

A protection mechanism failure in HttpsUpgrades in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through crafted network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

In Google Chrome, policy bypass in MHTML before version 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted MHTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Headless mode in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

A observable discrepancy in Performance APIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Information leakage in ServiceWorker in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper input validation in the Network in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Loader component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The information leak in Canvas in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the FileSystem of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Improper input validation in the Preload feature of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...