SUSE CVE-2026-72808

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-73048 SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

PT-2026-85352

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7ph-r5r6-4jcj. This link is maintained to preserve external references. Original Description SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the...

CVE-2026-72808: Missing Authorization

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

PT-2026-71250

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/asset/getFileAnnotation' endpoint. The endpoint returns .sya PDF-annotation file content without performing a publish-access check, as it is only...

PT-2026-56353

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists where the application fails to perform proper type checking when parsing a PDF containing an abnormal annotation referenced by other objects. This type confusi...

Malicious code in pdf-annotation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a9825714dd4a01b7deb1226158bce68ad4456f16230aed225cb7240d7c4344 The package pdf-annotation was found to contain malicious code. Source: ghsa-malware 955e80d981658c3ea77d6ae52df04c36931e4d9403d1a44976b8222b2aa9c4f4...

EUVD-2025-199058

Malicious code in pdf-annotation npm...

MAL-2025-190985 Malicious code in pdf-annotation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a9825714dd4a01b7deb1226158bce68ad4456f16230aed225cb7240d7c4344 The package pdf-annotation was found to contain malicious code. Source: ghsa-malware 955e80d981658c3ea77d6ae52df04c36931e4d9403d1a44976b8222b2aa9c4f4...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

mupdf:pdf_fuzzer: Crash in pdf_dict_get

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4839131497693184 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzerasanmupdf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x02008264b621 Crash State:...

Adobe Acrobat Reader FileAttachment PDAnnot destroy use-after-free vulnerability

Talos Vulnerability Report TALOS-2023-1901 Adobe Acrobat Reader FileAttachment PDAnnot destroy use-after-free vulnerability February 15, 2024 CVE Number CVE-2024-20731 SUMMARY A use-after-free vulnerability exists in the FileAttachment PDAnnot object processing in Adobe Acrobat Reader...

ghostscript:gstoraster_fuzzer: Stack-buffer-overflow in pdfi_annot_draw_LE_one

Detailed Report: https://oss-fuzz.com/testcase?key=5217927366836224 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7f058b574984 Crash State:...