Know what to patch next.

1. Medium, CVSS 5.83 Sep 2026

   SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724103335-f36331956ae9 (pre-release) or later · < 0.0.0-20260724103335-f36331956ae9 · CVE-2026-72800 · GHSA-5fhr-f75j-8wr9 · amended

   3 Sep 2026Evidence →
2. High, CVSS 7.53 Sep 2026

   SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724102025-3bc014c7dc32 (pre-release) or later · < 0.0.0-20260724102025-3bc014c7dc32 · CVE-2026-72801 · GHSA-8x84-r2ff-h8pq · amended

   3 Sep 2026Evidence →
3. Medium, CVSS 5.33 Sep 2026

   SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724095509-eee3410aa131 (pre-release) or later · < 0.0.0-20260724095509-eee3410aa131 · CVE-2026-72802 · GHSA-jv8v-xq2h-657v · amended

   3 Sep 2026Evidence →
4. Medium, CVSS 5.83 Sep 2026

   SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724093256-229fdffd7e4a (pre-release) or later · < 0.0.0-20260724093256-229fdffd7e4a · CVE-2026-72803 · GHSA-qvq9-hq6p-v378 · amended

   3 Sep 2026Evidence →
5. High, CVSS 8.63 Sep 2026

   SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724091654-82e9ded423e4 (pre-release) or later · < 0.0.0-20260724091654-82e9ded423e4 · CVE-2026-72804 · GHSA-vpjw-wf5h-cgpq · amended

   3 Sep 2026Evidence →
6. Medium, CVSS 5.83 Sep 2026

   SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723163028-931ba693375e (pre-release) or later · < 0.0.0-20260723163028-931ba693375e · CVE-2026-72805 · GHSA-67x2-mq63-v9vm · amended

   3 Sep 2026Evidence →
7. Medium, CVSS 5.83 Sep 2026

   SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723040913-768427f20f13 (pre-release) or later · < 0.0.0-20260723040913-768427f20f13 · CVE-2026-72806 · GHSA-6mcf-g667-w3qv · amended

   3 Sep 2026Evidence →
8. High, CVSS 8.03 Sep 2026

   SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723035036-0a176345e02a (pre-release) or later · < 0.0.0-20260723035036-0a176345e02a · CVE-2026-72807 · GHSA-x67c-8pwr-m8g3 · amended

   3 Sep 2026Evidence →
9. Medium, CVSS 5.83 Sep 2026

   SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031702-509b35055940 (pre-release) or later · < 0.0.0-20260723031702-509b35055940 · CVE-2026-72808 · GHSA-v7ph-r5r6-4jcj · amended

   3 Sep 2026Evidence →
10. High, CVSS 8.03 Sep 2026

    SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031701-9c16e9851f0b (pre-release) or later · < 0.0.0-20260723031701-9c16e9851f0b · CVE-2026-72809 · GHSA-3mp7-4rh5-jrv9 · amended

    3 Sep 2026Evidence →
11. High, CVSS 8.63 Sep 2026

    SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723013612-ba948639d7f6 (pre-release) or later · < 0.0.0-20260723013612-ba948639d7f6 · CVE-2026-72810 · GHSA-mw8r-mw84-88v2 · amended

    3 Sep 2026Evidence →
12. Critical, CVSS 10.03 Sep 2026

    SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723004839-1a5b3431d5ab (pre-release) or later · < 0.0.0-20260723004839-1a5b3431d5ab · CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc · amended

    3 Sep 2026Evidence →
13. Medium, CVSS 6.53 Sep 2026

    SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723002528-7d273c271ce1 (pre-release) or later · < 0.0.0-20260723002528-7d273c271ce1 · CVE-2026-72812 · GHSA-wgwx-479j-23vq · amended

    3 Sep 2026Evidence →
14. High, CVSS 8.73 Sep 2026

    rubyzip path traversal vulnerability

    RubyGems rubyzip · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85396 · GHSA-47m2-wp7j-p9vc · amended

    3 Sep 2026Evidence →
15. Critical, CVSS 9.33 Sep 2026

    python-jose algorithm confusion with OpenSSH ECDSA keys

    PyPI python-jose · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85394 · GHSA-3qf3-8w2g-rqmx · amended

    3 Sep 2026Evidence →
16. High, CVSS 8.63 Sep 2026

    SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721020826-2d069dce84a2 (pre-release) or later · < 0.0.0-20260721020826-2d069dce84a2 · CVE-2026-68584 · GHSA-7j72-f6wg-cxw6 · amended

    3 Sep 2026Evidence →
17. Medium, CVSS 5.83 Sep 2026

    SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014951-ffde3b21eca4 (pre-release) or later · < 0.0.0-20260721014951-ffde3b21eca4 · CVE-2026-68585 · GHSA-pm3w-vxp9-ccwc · amended

    3 Sep 2026Evidence →
18. High, CVSS 8.63 Sep 2026

    SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014413-f45749a7ef6e (pre-release) or later · < 0.0.0-20260721014413-f45749a7ef6e · CVE-2026-68586 · GHSA-36v8-mpjm-8j5r · amended

    3 Sep 2026Evidence →
19. High, CVSS 8.63 Sep 2026

    SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721013353-69db783b782a (pre-release) or later · < 0.0.0-20260721013353-69db783b782a · CVE-2026-68587 · GHSA-69mh-gvh4-8gp7 · amended

    3 Sep 2026Evidence →
20. Critical, CVSS 10.03 Sep 2026

    SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721004815-cf42dd5680c8 (pre-release) or later · < 0.0.0-20260721004815-cf42dd5680c8 · CVE-2026-69083 · GHSA-fph3-ghq9-vw66 · amended

    3 Sep 2026Evidence →
21. High, CVSS 7.53 Sep 2026

    toml-node: Uncontrolled Recursion

    npm toml · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-77465 · GHSA-82x6-q7mm-w9cf

    3 Sep 2026Evidence →
22. High, CVSS 8.23 Sep 2026

    toml-node: Prototype Pollution Leads to Object.prototype Corruption via __proto__ Key-Path Desynchronization

    npm toml · Upgrade to 4.1.2 or later · < 4.1.2 · CVE-2026-63376 · GHSA-v5mp-jgw5-2x6j

    3 Sep 2026Evidence →
23. High, CVSS 7.73 Sep 2026

    SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260720151813-0f5a0e7c67b0 (pre-release) or later · < 0.0.0-20260720151813-0f5a0e7c67b0 · CVE-2026-69086 · GHSA-7hm9-v7vf-7g4w · amended

    3 Sep 2026Evidence →
24. Medium, CVSS 6.33 Sep 2026

    Phoenix: Presence keys colliding with Object.prototype members break existence checks

    npm phoenix · Upgrade to 1.8.9, 1.7.24, 1.6.17 or 1.5.15 by release line · >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9 · CVE-2026-56812 · GHSA-63mc-hw7g-86rr

    3 Sep 2026Evidence →
25. Medium, CVSS 6.23 Sep 2026

    stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

    npm stream-json · Upgrade to 3.5.0 or later · <= 3.4.0 · CVE-2026-71429 · GHSA-528h-pc64-c93x

    3 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.