Know what to patch next.

1. High, CVSS 7.53 Sep 2026

   SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724102025-3bc014c7dc32 (pre-release) or later · < 0.0.0-20260724102025-3bc014c7dc32 · CVE-2026-72801 · GHSA-8x84-r2ff-h8pq · amended

   3 Sep 2026Evidence →
2. High, CVSS 8.63 Sep 2026

   SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724091654-82e9ded423e4 (pre-release) or later · < 0.0.0-20260724091654-82e9ded423e4 · CVE-2026-72804 · GHSA-vpjw-wf5h-cgpq · amended

   3 Sep 2026Evidence →
3. High, CVSS 8.03 Sep 2026

   SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723035036-0a176345e02a (pre-release) or later · < 0.0.0-20260723035036-0a176345e02a · CVE-2026-72807 · GHSA-x67c-8pwr-m8g3 · amended

   3 Sep 2026Evidence →
4. High, CVSS 8.03 Sep 2026

   SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031701-9c16e9851f0b (pre-release) or later · < 0.0.0-20260723031701-9c16e9851f0b · CVE-2026-72809 · GHSA-3mp7-4rh5-jrv9 · amended

   3 Sep 2026Evidence →
5. High, CVSS 8.63 Sep 2026

   SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723013612-ba948639d7f6 (pre-release) or later · < 0.0.0-20260723013612-ba948639d7f6 · CVE-2026-72810 · GHSA-mw8r-mw84-88v2 · amended

   3 Sep 2026Evidence →
6. Critical, CVSS 10.03 Sep 2026

   SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write…

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723004839-1a5b3431d5ab (pre-release) or later · < 0.0.0-20260723004839-1a5b3431d5ab · CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc · amended

   3 Sep 2026Evidence →
7. High, CVSS 8.73 Sep 2026

   rubyzip path traversal vulnerability

   RubyGems rubyzip · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85396 · GHSA-47m2-wp7j-p9vc · amended

   3 Sep 2026Evidence →
8. Critical, CVSS 9.33 Sep 2026

   python-jose algorithm confusion with OpenSSH ECDSA keys

   PyPI python-jose · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85394 · GHSA-3qf3-8w2g-rqmx · amended

   3 Sep 2026Evidence →
9. High, CVSS 8.63 Sep 2026

   SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721020826-2d069dce84a2 (pre-release) or later · < 0.0.0-20260721020826-2d069dce84a2 · CVE-2026-68584 · GHSA-7j72-f6wg-cxw6 · amended

   3 Sep 2026Evidence →
10. High, CVSS 8.63 Sep 2026

    SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014413-f45749a7ef6e (pre-release) or later · < 0.0.0-20260721014413-f45749a7ef6e · CVE-2026-68586 · GHSA-36v8-mpjm-8j5r · amended

    3 Sep 2026Evidence →
11. High, CVSS 8.63 Sep 2026

    SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721013353-69db783b782a (pre-release) or later · < 0.0.0-20260721013353-69db783b782a · CVE-2026-68587 · GHSA-69mh-gvh4-8gp7 · amended

    3 Sep 2026Evidence →
12. Critical, CVSS 10.03 Sep 2026

    SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721004815-cf42dd5680c8 (pre-release) or later · < 0.0.0-20260721004815-cf42dd5680c8 · CVE-2026-69083 · GHSA-fph3-ghq9-vw66 · amended

    3 Sep 2026Evidence →
13. High, CVSS 7.53 Sep 2026

    toml-node: Uncontrolled Recursion

    npm toml · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-77465 · GHSA-82x6-q7mm-w9cf

    3 Sep 2026Evidence →
14. High, CVSS 8.23 Sep 2026

    toml-node: Prototype Pollution Leads to Object.prototype Corruption via __proto__ Key-Path Desynchronization

    npm toml · Upgrade to 4.1.2 or later · < 4.1.2 · CVE-2026-63376 · GHSA-v5mp-jgw5-2x6j

    3 Sep 2026Evidence →
15. High, CVSS 7.73 Sep 2026

    SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260720151813-0f5a0e7c67b0 (pre-release) or later · < 0.0.0-20260720151813-0f5a0e7c67b0 · CVE-2026-69086 · GHSA-7hm9-v7vf-7g4w · amended

    3 Sep 2026Evidence →
16. Critical, CVSS 10.03 Sep 2026

    SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721002947-23a17d44b5f3 (pre-release) or later · < 0.0.0-20260721002947-23a17d44b5f3 · CVE-2026-69084 · GHSA-vh22-h7hf-www7 · amended

    3 Sep 2026Evidence →
17. High, CVSS 8.93 Sep 2026

    amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

    Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp · amended

    3 Sep 2026Evidence →
18. High, CVSS 8.33 Sep 2026

    TOON: Prototype pollution when decoding untrusted TOON input

    npm @toon-format/toon · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2026-82404 · GHSA-p95v-992w-h6c3

    3 Sep 2026Evidence →
19. High, CVSS 8.83 Sep 2026

    Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

    npm claude-code-templates · Upgrade to 1.29.4 or later · <= 1.29.2 · CVE-2026-73222 · GHSA-79wm-x847-7cvg

    3 Sep 2026Evidence →
20. High, CVSS 8.83 Sep 2026

    Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

    Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 (pre-release) or later · < 0.0.0-20260705182501-bb2a4e1f08c8 · CVE-2026-73293 · GHSA-cxvf-gvfq-36w2 · amended

    3 Sep 2026Evidence →
21. High, CVSS 7.63 Sep 2026

    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260707190631-c59c3dc9035b (pre-release) or later · < 0.0.0-20260707190631-c59c3dc9035b · CVE-2026-73292 · GHSA-8cj9-r88m-8945 · amended

    3 Sep 2026Evidence →
22. Critical, CVSS 9.33 Sep 2026

    Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

    npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62681 · GHSA-fg9p-mrxr-hvq7 · amended

    3 Sep 2026Evidence →
23. Critical, CVSS 9.33 Sep 2026

    Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

    npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62682 · GHSA-88f2-fpv8-89q2 · amended

    3 Sep 2026Evidence →
24. Critical, CVSS 9.33 Sep 2026

    Orval: Import-time RCE via schema default -> zod module-level template literal

    npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72717 · GHSA-w727-8j6c-2rj4 · amended

    3 Sep 2026Evidence →
25. Critical, CVSS 9.33 Sep 2026

    Orval: Import-time RCE via array-items default -> zod module-level template literal

    npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71869 · GHSA-2h9g-j24r-h63g · amended

    3 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.