CVE-2026-75917

SiYuan before v3.7.4 contains an XSS-to-RCE vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()). Document metadata fields (bookmark, alias, memo, alternate name) are concatenated into the aria-label HTML attribute without escaping, a...

CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

CVE-2026-75916

In SiYuan through 3.7.3, genHintItemHTML() in app/src/protyle/hint/extend.ts concatenates block name, alias, and memo fields into HTML without escaping, enabling XSS via '((' autocomplete popups. Combined with nodeIntegration enabled, contextIsolation disabled, and no CSP, this escalates to arbit...

EUVD-2026-62441

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

CVE-2024-58376

Renovate versions 37.158.0 through 37.198.0 are affected by a command injection vulnerability in the helmv3 manager's registryAliases handling. Since PR #26848 made registryAliases mergeable, the helmv3 manager executes helm repo add for each defined alias. The key was not quoted , allowing att...

EUVD-2024-55728

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2026-70422

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-70422

Dell OpenManage Enterprise versions prior to 4.7.0 contain a SQL Injection vulnerability (CWE-89). A low-privileged attacker with remote network access can exploit this to achieve script injection , resulting in high confidentiality and availability impact (CVSS 3.1: 8.1 HIGH ). CISA's SSVC asses...

EUVD-2026-62439

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-70422

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-16019 SQL Injection in Faydam Innovation's FAYDAM Datalogger

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0...

EUVD-2026-62438

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0...

CVE-2026-16019

FAYDAM Datalogger (by Faydam Innovation Inc.) is affected by a SQL injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions 2.7.1 through before 2.8.0 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector requirin...

CVE-2026-16019 SQL Injection in Faydam Innovation's FAYDAM Datalogger

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0...

EUVD-2026-62436

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-56088

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...