CVE-2026-74800

SiYuan before v3.7.4 serves uploaded HTML files without Content-Disposition or X-Content-Type-Options headers, enabling authenticated attackers to inject stored XSS that runs with full kernel API access when the workspace owner clicks the asset link; upgrade to v3.7.4 or later. No active exploita...