CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Simple Proof of Concept Tool 🛠 About This Application This tool shows a technical proof of concept PoC for the security issue CVE-2026-2472. The issue affects the Vertex AI Python SDK from Google Cloud Platform. It relates to an unauthenticated and...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

jupyter-notebooks

VulnCheck Jupyter Notebooks Jupyter allows you to combine markdown and code into a single interactive canvas. This project provides example Jupyter notebooks that pull data from VulnCheck and display it in charts. For more actively maintained examples, see vulncheck-oss/vulnerability-research...

Astra Linux – Vulnerability in nbconvert

The GitHub Security Lab identified sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting XSS vulnerabilities if...

msticpy

Herramientas de Seguridad en Python y Jupyter de MSTIC Herramientas de Seguridad en Python de Microsoft Threat Intelligence. msticpy es una biblioteca para investigación y caza en ciberseguridad en Jupyter Notebooks. Incluye funcionalidad para: consultar datos de registros de múltiples fuentes...

SUSE CVE-2026-72789

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

GO-2026-6431 SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel...

GHSA-V684-Q882-JGMQ SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

CVE: This vulnerability corresponds to CVE-2026-72789. Summary publishAccess.json is an opt-out list. The publish gate returns accessible for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated setPublishAccess writes it...

EUVD-2026-57449

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked...

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...

EUVD-2026-57457

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers...

CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

EUVD-2026-52277

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

finn-plus (1.2.0), finn-plus-notebooks (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-79720 via netron (8.5.0)

netron PYPI version 8.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on netron and may be impacted: - finn-plus 1.2.0 - finn-plus-notebooks =1.3.0, =1.4.0 Source cves: CVE-2026-79720 Source advisory: OSV:PYSEC-2026-3747...

finn-plus (1.2.0), finn-plus-notebooks (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-79718 via netron (8.5.0)

netron PYPI version 8.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on netron and may be impacted: - finn-plus 1.2.0 - finn-plus-notebooks =1.3.0, =1.4.0 Source cves: CVE-2026-79718 Source advisory: OSV:PYSEC-2026-4001...

finn-plus (1.2.0), finn-plus-notebooks (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-79719 via netron (8.5.0)

netron PYPI version 8.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on netron and may be impacted: - finn-plus 1.2.0 - finn-plus-notebooks =1.3.0, =1.4.0 Source cves: CVE-2026-79719 Source advisory: OSV:PYSEC-2026-4002...