CVE-2026-87814

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by William Honnér in WordPress Plugin WP Fast Total Search versions = 1.82.284...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

EUVD-2026-74840

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

EUVD-2026-74839

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the search asset preview feature. The root cause is a failure to escape indexed asset content before inserting it into the DOM via innerHTML . An attacker who can place crafted text assets in a workspace can ...

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87813

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Search Assets result list , where asset filenames are interpolated into HTML without proper escaping. An authenticated attacker can craft asset filenames containing malicious markup that executes JavaScri...

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots of searching and testing. EDITED TO ADD 9/14: I'm not sure if this result is correct. The blog comments have more discussion...

CVE-2026-87530

A flaw was found in the CredentialProvider component of Google Chrome on Windows. This vulnerability, an uncontrolled search path element, allows a local attacker to execute arbitrary code. By exploiting this flaw via a local program, an attacker can bypass the browser's sandbox and run malicious...

DEBIAN-CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

EUVD-2026-74395

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...