CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

CVE-2026-72810 SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

CVE-2026-72810

SiYuan is affected by CVE-2026-72810: versions before 3.7.4 have a publish-boundary bypass in WebSocket broadcast sessions, allowing anonymous readers to receive unfiltered real-time edits including password-protected/forbidden documents without authentication. The issue is triggered via a WebSoc...

CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

Malicious code in zip-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vyzensockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a38578ec3825683bc7646595c0676583ebf4bb3b5c36b5b92c5c7f4537e653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm_pkg_1094 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe875cbf7a0714bb15d688c4eeba441eb6d7f02a73dd3657c11ade00e64bbc00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm_pkg_1093 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbcfd38e8ac9c31e28e53af79f450b1bf48ee623593d4dfd77388c945f802653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in utils-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd71448526f4ee786e1e42e6bdb66627a4f5e8fac78ddb8e8205bd26cc1b0dcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...

Malicious code in saps_secplayground_npm_ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13fa9c8b7672d88eb66c92e717080df3e10efc1b6f881b2f7361af0a5a7fbb37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions = 4.16.5.1...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability

Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...

WordPress Wishlist Member X plugin <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability

Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability discovered by bashu - VN in WordPress Plugin WishList Member X versions = 3.34.1...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability

Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...

CVE-2026-65975

A flaw was found in Pydantic AI's UI adapters, specifically within the sanitizemessages function. This vulnerability allows a remote client to bypass security checks and execute server tools with arguments they provide, rather than those generated by the AI model. This occurs when a trailing clie...