CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

EUVD-2026-60586

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905

SiYuan before v3.7.4 contains a full-read SSRF vulnerability in the isPrivateIP function (kernel/util/net.go), which powers the SSRFSafeDialer SSRF guard in SafeMode. The function fails to recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed privat...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

AI-for-fastjson-1.2.83-RCE-skill

fastjson-1.2.83-RCEskill AI agent skill for detecting and exp...

fastjson-1.2.83-poc

Fastjson 1.2.84 ，。 Why no need for Gadgets | Hi...

CVE-2026-33500

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 GHSA-rcqw-6466-3mv7 introduced a custom ParsedownSafeWithLinks class that sanitizes raw HTML and tags in comments, but explicitly disables Parsedown's safeMode. This creates a bypass:...

CVE-2025-14896

CVE-2025-14896 affects Vega. The issue is insufficient sanitization in Vega’s convert() function when safeMode is enabled and the diagram spec is an array. An attacker can craft a malicious Vega diagram specification that can cause requests to arbitrary URLs, including local filesystem paths, pot...

EUVD-2007-1454

Malware in sbrugna...

EUVD-2017-0171

Malware in sbrugna...

EUVD-2017-0213

Malware in sbrugna...

EUVD-2023-36815

Malicious code in bioql PyPI...

EUVD-2023-32069

Malicious code in bioql PyPI...

CVE-2023-28373

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode...

CVE-2023-32572

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection...

CVE-2023-28373

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode...

CVE-2023-32572

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection...

Design/Logic Flaw

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection...

Code injection

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode...