EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2026-101091

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

PT-2026-102387

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient validation of SQL statements in block query embed blocks executed against siyuan.db allows for the execution of non-read-only SQL statements. An attacker can create malicious .sy document...

CVE-2026-101091: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2026-96895

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

EUVD-2026-87898

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

PT-2026-99503

Name of the Vulnerable Software and Affected Versions WP YouTube Lyte WordPress plugin versions prior to 1.7.31 Description Insufficient escaping of attributes within YouTube embed blocks occurs during the rendering process when they are outputted into an HTML attribute. This flaw allows users wi...

CVE-2026-96895: Improper Neutralization of Input During Web Page Generation

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-82652 SiYuan before v3.8.1 Information Disclosure via Publish Access

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

CVE-2026-82652

SiYuan before v3.8.1 is affected by an information disclosure vulnerability in publish mode . The application fails to filter invisible-tier content from three listing mechanisms: SQL embed blocks , attribute-view keys , and attribute-view backlinks . As a result, anonymous readers can enumerate ...

CVE-2026-82652

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

CVE-2026-82652 SiYuan before v3.8.1 Information Disclosure via Publish Access

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

PT-2026-83578

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

CVE-2026-82652: Exposure of Resource to Wrong Sphere

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...