All CVEs — page 441 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• UNSCOREDCVE-2026-1006552026-09-26
• MEDIUM 6.5CVE-2026-100654public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100653public exploit available2026-09-26
• MEDIUM 5.9CVE-2026-100652public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100651public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100650public exploit available2026-09-26
• LOW 3.7CVE-2026-100649public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100648public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100647public exploit available2026-09-26
• HIGH 8.1CVE-2026-100646public exploit available2026-09-26

  The flaw in SiYuan allows an attacker to bypass authentication by exploiting the absence of the HTTP Origin header, granting RoleAdministrator privileges and enabling arbitrary script execution in the SiYuan origin.

• HIGH 8CVE-2026-100645public exploit available2026-09-26

  SiYuan versions 3.7.0 before 3.8.4 are vulnerable to stored cross-site scripting, allowing attackers to inject JavaScript that can execute arbitrary commands with user privileges via Electron desktop app with nodeIntegration enabled.

• HIGH 7.5CVE-2026-100644public exploit available2026-09-26

  A SQL injection vulnerability in SiYuan's graph query endpoint allows unauthenticated attackers to inject arbitrary SQL and extract data from all notebooks without any authentication or user interaction.

• HIGH 8CVE-2026-100643public exploit available2026-09-26

  The flaw allows authenticated attackers to inject JavaScript by modifying specific field descriptions, leading to potential command execution with SiYuan process privileges.

• HIGH 7.6CVE-2026-100642public exploit available2026-09-26

  The vulnerability allows attackers to perform administrative actions on SiYuan instances without authentication by exploiting a missing Origin header validation in the lock-screen pass-through mechanism. This enables attackers to terminate kernel processes, access workspace configurations, and trigger admin actions through crafted web pages that victims' browsers automatically execute.

• HIGH 8CVE-2026-100641public exploit available2026-09-26

  SiYuan before v3.8.4 fails to properly HTML-escape stored flashcard content, leading to potential arbitrary code execution in the privileged renderer process.

• MEDIUM 4.7CVE-2026-100640public exploit available2026-09-26
• HIGH 8.8CVE-2026-100639public exploit available2026-09-26

  The flaw allows an attacker to inject arbitrary attributes into HTML content, leading to potential remote code execution when the affected control receives focus in the SiYuan application.

• HIGH 7.6CVE-2026-100638public exploit available2026-09-26

  An authenticated administrator can exploit a path traversal vulnerability in SiYuan's setNotebookIcon endpoint to write files outside the workspace boundary, potentially allowing arbitrary code execution or configuration manipulation.

• HIGH 7.6CVE-2026-100637public exploit available2026-09-26

  A path traversal vulnerability in SiYuan's checkoutRepo endpoint allows authenticated administrators to write arbitrary JSON files outside their workspace directory, potentially enabling attackers to overwrite critical system configuration files. This affects versions before v3.8.4.

• HIGH 7.6CVE-2026-100636public exploit available2026-09-26

  A path traversal vulnerability in SiYuan's exportBrowserHTML endpoint allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory, potentially enabling stored XSS or workspace defacement.

• MEDIUM 5.9CVE-2026-100635public exploit available2026-09-26
• MEDIUM 4.7CVE-2026-100634public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100633public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100632public exploit available2026-09-26
• HIGH 7.5CVE-2026-100631public exploit available2026-09-26

  Parse Server allows unauthenticated attackers to delete all device registrations through improper validation of installation fields, leading to permanent loss of push notification capabilities for affected applications.