CVE-2026-73099

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Juneau versions through 9.2.0 . The REST server's default behavior allows the "content" query parameter to replace the request body for all HTTP methods, including GET. This enables an attacker to deliver a chosen request body via...

CVE-2026-23847 SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons type=8. The content query parameter is inserted directly into the S...

CVE-2026-23847: Improper Neutralization of Input During Web Page Generation

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons type=8. The content query parameter is inserted directly into the S...