GO-2026-6113 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList...

CVE-2026-75898

RAGFlow before 0.26.3 lacks URL validation in the agent Invoke component (agent/component/invoke.py), allowing low-privilege users to force the server to fetch internal metadata endpoints and return responses. Patch is available in v0.26.3. Exploitation details are not provided in the documents.

EUVD-2026-60824

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

GHSA-69JP-F2P8-9VRG Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go...

Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go...

CVE-2026-75844

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

CVE-2026-74904

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-75844

ArcadeDB versions before 26.8.1 have an SSRF flaw in the IMPORT DATABASE command: the security validator checks the hostname once, but the actual connection re-resolves the raw URL and follows redirects, allowing authenticated attackers to bypass validation via DNS rebinding or HTTP redirects to ...

CVE-2026-75844

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

EUVD-2026-60608

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74904

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

EUVD-2026-60586

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74904

In SiYuan before v3.7.4, 17 block endpoints in kernel/api/block.go (getRefText, checkBlockExist, getBlockBreadcrumb) are gated only by model.CheckAuth without publish-access filtering, letting anonymous publish-mode readers disclose private block content, metadata, and existence info. Patch to v3...