119 matches found
EUVD-2026-91717
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...
CVE-2026-104914
MISP versions prior to v2.5.48 are vulnerable to an improper access control vulnerability in its attribute search and paginated attribute view endpoints. The root cause is a lack of visibility restrictions in these specific code paths; while the event detail view correctly restricts soft-deleted ...
CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...
CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...
SUSE CVE-2026-72807
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...
GO-2026-6388 SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Password protected tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password publish mode in github.com/siyuan-note/siyuan/kernel...
GO-2026-6373 SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel...
GHSA-57V5-WQX3-CGJ4 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
Scope note please read first This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 "Improve database field visibility across views", 11020 and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable...
CVE-2026-86191
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
CVE-2026-86192
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
EUVD-2026-72012
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
CVE-2026-86192
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeys endpoint. The root cause is a failure to properly filter private attribute-view cell values, allowing publish readers to retrieve hidden KeyValues payloads from rows bound to inaccessible doc...
CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
CVE-2026-86191
SiYuan versions before v3.8.2 are affected by an information disclosure vulnerability in the getAttributeViewKeysByID endpoint. The root cause is that publish readers can enumerate private attribute view key definitions without the system verifying parent database visibility, allowing attackers t...
CVE-2026-86191: Authorization Bypass Through User-Controlled Key
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
PT-2026-86417
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...