CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

EUVD-2026-81623

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985

SiYuan versions before 3.8.4 are affected by a Cross-Site Scripting (XSS) vulnerability in bookmark labels imported from ".sy" notebook files. The root cause is a failure to escape HTML in bookmark attributes when rendering them in the dock tree . Because SiYuan runs on Electron , injected script...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

EUVD-2026-81622

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92985 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

CVE-2026-92957

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

Malicious code in tailwindcss-contact-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b Package presents itself as the Tailwind CSS forms plugin README is a verbatim copy of @tailwindcss/forms and its package.json points at...

MAL-2026-16251 Malicious code in tailwindcss-contact-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b Package presents itself as the Tailwind CSS forms plugin README is a verbatim copy of @tailwindcss/forms and its package.json points at...

MGASA-2026-0414 Updated imagemagick package fixes security vulnerabilities

Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory...

Updated imagemagick package fixes security vulnerabilities

Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory...

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process informati...

Exploit for Command Injection in Microsoft

CVE-2026-49179: Active Directory WriteSPNScript Command Inject...

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-81606

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...