Know what to patch next.

1. Critical, CVSS 9.48 Sep 2026

   @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

   npm @sap/cds-mtxs · Upgrade to 4.0.3, 3.9.7, 2.7.7 or 1.18.4 by release line · >= 4.0.1, < 4.0.3; >= 3.0.1, < 3.9.7; >= 2.0.2, < 2.7.7; < 1.18.4 · CVE-2026-76969 · GHSA-955m-rr6m-2f9v · amended

   8 Sep 2026Evidence →
2. High, CVSS 7.54 Sep 2026

   TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

   npm @typespec/spector · Upgrade to 0.1.0-alpha.27 (pre-release) or later · <= 0.1.0-alpha.26 · GHSA-7q9c-hpx7-9cwm · amended

   4 Sep 2026Evidence →
3. High, CVSS 8.64 Sep 2026

   SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to…

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725132049-2d8b98395a91 (pre-release) or later · < 0.0.0-20260725132049-2d8b98395a91 · CVE-2026-72793 · GHSA-h4v5-crx2-3cv4 · amended

   4 Sep 2026Evidence →
4. High, CVSS 8.64 Sep 2026

   SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725125659-1ca1c3c9d94b (pre-release) or later · < 0.0.0-20260725125659-1ca1c3c9d94b · CVE-2026-72795 · GHSA-h6w7-xxcf-w2mq · amended

   4 Sep 2026Evidence →
5. High, CVSS 8.64 Sep 2026

   SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725123945-77421530be4a (pre-release) or later · < 0.0.0-20260725123945-77421530be4a · CVE-2026-72794 · GHSA-34fj-mwm6-fjfg · amended

   4 Sep 2026Evidence →
6. High, CVSS 8.64 Sep 2026

   SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724121519-426991d155c0 (pre-release) or later · < 0.0.0-20260724121519-426991d155c0 · CVE-2026-72798 · GHSA-mfrj-v65r-979c · amended

   4 Sep 2026Evidence →
7. High, CVSS 8.14 Sep 2026

   SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

   crates.io surrealdb · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63735 · GHSA-848m-r628-vrxw · amended

   4 Sep 2026Evidence →
8. High, CVSS 7.53 Sep 2026

   SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724102025-3bc014c7dc32 (pre-release) or later · < 0.0.0-20260724102025-3bc014c7dc32 · CVE-2026-72801 · GHSA-8x84-r2ff-h8pq · amended

   3 Sep 2026Evidence →
9. High, CVSS 8.63 Sep 2026

   SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724091654-82e9ded423e4 (pre-release) or later · < 0.0.0-20260724091654-82e9ded423e4 · CVE-2026-72804 · GHSA-vpjw-wf5h-cgpq · amended

   3 Sep 2026Evidence →
10. High, CVSS 8.03 Sep 2026

    SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723035036-0a176345e02a (pre-release) or later · < 0.0.0-20260723035036-0a176345e02a · CVE-2026-72807 · GHSA-x67c-8pwr-m8g3 · amended

    3 Sep 2026Evidence →
11. High, CVSS 8.03 Sep 2026

    SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031701-9c16e9851f0b (pre-release) or later · < 0.0.0-20260723031701-9c16e9851f0b · CVE-2026-72809 · GHSA-3mp7-4rh5-jrv9 · amended

    3 Sep 2026Evidence →
12. High, CVSS 8.63 Sep 2026

    SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723013612-ba948639d7f6 (pre-release) or later · < 0.0.0-20260723013612-ba948639d7f6 · CVE-2026-72810 · GHSA-mw8r-mw84-88v2 · amended

    3 Sep 2026Evidence →
13. Critical, CVSS 10.03 Sep 2026

    SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723004839-1a5b3431d5ab (pre-release) or later · < 0.0.0-20260723004839-1a5b3431d5ab · CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc · amended

    3 Sep 2026Evidence →
14. High, CVSS 8.73 Sep 2026

    rubyzip path traversal vulnerability

    RubyGems rubyzip · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85396 · GHSA-47m2-wp7j-p9vc · amended

    3 Sep 2026Evidence →
15. Critical, CVSS 9.33 Sep 2026

    python-jose algorithm confusion with OpenSSH ECDSA keys

    PyPI python-jose · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85394 · GHSA-3qf3-8w2g-rqmx · amended

    3 Sep 2026Evidence →
16. High, CVSS 8.63 Sep 2026

    SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721020826-2d069dce84a2 (pre-release) or later · < 0.0.0-20260721020826-2d069dce84a2 · CVE-2026-68584 · GHSA-7j72-f6wg-cxw6 · amended

    3 Sep 2026Evidence →
17. High, CVSS 8.63 Sep 2026

    SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014413-f45749a7ef6e (pre-release) or later · < 0.0.0-20260721014413-f45749a7ef6e · CVE-2026-68586 · GHSA-36v8-mpjm-8j5r · amended

    3 Sep 2026Evidence →
18. High, CVSS 8.63 Sep 2026

    SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721013353-69db783b782a (pre-release) or later · < 0.0.0-20260721013353-69db783b782a · CVE-2026-68587 · GHSA-69mh-gvh4-8gp7 · amended

    3 Sep 2026Evidence →
19. Critical, CVSS 10.03 Sep 2026

    SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721004815-cf42dd5680c8 (pre-release) or later · < 0.0.0-20260721004815-cf42dd5680c8 · CVE-2026-69083 · GHSA-fph3-ghq9-vw66 · amended

    3 Sep 2026Evidence →
20. High, CVSS 7.53 Sep 2026

    toml-node: Uncontrolled Recursion

    npm toml · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-77465 · GHSA-82x6-q7mm-w9cf

    3 Sep 2026Evidence →
21. High, CVSS 8.23 Sep 2026

    toml-node: Prototype Pollution Leads to Object.prototype Corruption via __proto__ Key-Path Desynchronization

    npm toml · Upgrade to 4.1.2 or later · < 4.1.2 · CVE-2026-63376 · GHSA-v5mp-jgw5-2x6j

    3 Sep 2026Evidence →
22. High, CVSS 7.73 Sep 2026

    SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260720151813-0f5a0e7c67b0 (pre-release) or later · < 0.0.0-20260720151813-0f5a0e7c67b0 · CVE-2026-69086 · GHSA-7hm9-v7vf-7g4w · amended

    3 Sep 2026Evidence →
23. Critical, CVSS 10.03 Sep 2026

    SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721002947-23a17d44b5f3 (pre-release) or later · < 0.0.0-20260721002947-23a17d44b5f3 · CVE-2026-69084 · GHSA-vh22-h7hf-www7 · amended

    3 Sep 2026Evidence →
24. High, CVSS 8.93 Sep 2026

    amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

    Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp · amended

    3 Sep 2026Evidence →
25. High, CVSS 8.33 Sep 2026

    TOON: Prototype pollution when decoding untrusted TOON input

    npm @toon-format/toon · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2026-82404 · GHSA-p95v-992w-h6c3

    3 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.