CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86711: Exposed Dangerous Method or Function

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-87038

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-88534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker wh...

PT-2026-88539

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ServiceWorker, which allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page...

PT-2026-88599

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation ...

PT-2026-88638

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A clickjacking issue in the Input component allows a remote attacker to spoof UI elements using a crafted HTML page. This exploitation requires the attacker to have already compromised...

PT-2026-88610

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in the FileAPI allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted...

PT-2026-88747

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An uninitialized resource in the GPU allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. Recommendations...

PT-2026-88631

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Cross-Origin Resource Sharing CORS implementation. A remote attacker who has already compromised the renderer process can use a crafted HTML page to...

PT-2026-88565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Downloads component allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-88533

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A race condition exists in the FileAPI. This allows a remote attacker who has already compromised the renderer process to bypass site isolation, which is a security mechanism used to...

PT-2026-88579

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Insufficient policy enforcement in Extensions allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This requires the attacker to...

PT-2026-88532

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Navigation allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations Update Google...

PT-2026-88535

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ControlledFrame component. A remote attacker who has already compromised the renderer process can obtain sensitive information by using a specially...

PT-2026-88585

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker...

PT-2026-88711

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page...

PT-2026-88605

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolatio...

PT-2026-88624

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue in Core allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page...