EUVD-2026-30356

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar community marketplace renders the name and version fields of a package's plugin.json and the equivalent theme.json / template.json / widget.json / icon.json into the Settings → Marketplace UI without HT...

CVE-2026-44586

SiYuan (desktop) Bazaar marketplace before 3.7.0 renders package author metadata into HTML without escaping, enabling stored XSS. Because Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload could access Node.js APIs and run code on the host. A...

PT-2022-15851 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 3.7.0 and earlier Description: The issue concerns the Jenkins HashiCorp Vault Plugin, where Vault credentials are not masked in Pipeline build logs or in Pipeline step descriptions when the Pipeline:...