Selective Channel Restoration for Backdoored Vision-Language Models

Vision-language models VLMs exhibit strong multimodal capabilities but remain vulnerable to backdoors implanted through poisoned fine-tuning data. Existing defenses often require extensive parameter updates during fine-tuning or incur per-query overhead during inference. To address these...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

EUVD-2026-87738

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644

Versions of SiYuan prior to v3.8.4 are vulnerable to a SQL injection vulnerability within the graph query endpoint . The root cause is the improper concatenation of the dailyNoteSavePath parameter into SQL queries without sufficient escaping. This flaw allows unauthenticated attackers targeting p...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644: Improper Neutralization of Special Elements used in an SQL Command

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100192

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192

X-SpringBoot versions through 6.0 are vulnerable to credential exposure via the GET /application/manager/select endpoint. The root cause is a lack of authentication and field filtering , allowing unauthenticated attackers to retrieve appKey and appSecret credentials. Successful exploitation enabl...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

EUVD-2026-87253

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-87459

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Select component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-100192: Missing Authentication for Critical Function

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

CVE-2026-94181

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

EUVD-2026-85565

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181

Affected versions of the Arc browser are susceptible to an address bar spoofing issue. An attacker can spoof the browser address bar by utilizing a element that triggers requestFullscreen without displaying the standard fullscreen notification. Exploitation details are not provided in the docume...