Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-33jq-p8c2-q3q4. This link is maintained to preserve external references. Original Description SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the...

Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vh22-h7hf-www7. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL stateme...

CVE-2026-69084

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-69085 SiYuan before v3.7.3 SQL Injection via searchDocs

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

PT-2026-67405

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Unauthenticated users can exploit SQL injection in the 'fullTextSearchAssetContent' endpoint. By using unescaped method parameters and REGEXP clauses, attackers can execute arbitrary SQL commands on t...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 – Android arm64 Local Privilege Escalation A res...

SUSE CVE-2026-8052

HashiCorp Nomad's exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability CVE-2026-8052 is fixed in version 0.1.2 of the exec2 task driver...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031

SFTPGo before 2.7.4 contains a permission bypass vulnerability where an authenticated user can circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite are denied. Exploitation relies on th...

CVE-2026-67594

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-48499

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...