CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-81623

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985

SiYuan versions before 3.8.4 are affected by a Cross-Site Scripting (XSS) vulnerability in bookmark labels imported from ".sy" notebook files. The root cause is a failure to escape HTML in bookmark attributes when rendering them in the dock tree . Because SiYuan runs on Electron , injected script...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

EUVD-2026-81622

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92957

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process informati...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957

vm2 through 3.11.6 does not normalize "node:"-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the "node:" prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957

vm2 (a Node.js sandboxing library) through version 3.11.6 fails to normalize node:-prefixed builtin specifiers when matching negative entries in a NodeVM wildcard require policy. Because deny-list entries are compared by exact string against canonical builtin names, a policy like ['*', '-node:chi...

CVE-2026-92935

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes "hasRealRequireConfig" with "typeof requireOpts === 'object' && requireOpts !== null", so an array-shaped "require" value for example "require: " satisfies the guard that is mea...

Exploit for SQL Injection in Cisco Asyncos

CVE-2026-76461 Vulnerability Exercise This project contains a...

Vulnerabilities found in Cisco Identity Services Engine (ISE)

Cisco has identified 21 vulnerabilities in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC. These vulnerabilities concern various security issues in Cisco ISE and ISE-PIC, including opportunities for unauthorized and low-privilege malicious actors to perform...

Malicious code in learning_npm1 (npm)

Source: ossf-package-analysis f3b173b32e267c6a9b7455320bda81f08ce154ad6315aeaea540133a9f0ab232 The OpenSSF Package Analysis project identified 'learningnpm1' @ 100.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...