Know what to patch next.

1. High, CVSS 8.64 Sep 2026

   SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to…

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725132049-2d8b98395a91 (pre-release) or later · < 0.0.0-20260725132049-2d8b98395a91 · CVE-2026-72793 · GHSA-h4v5-crx2-3cv4 · amended

   4 Sep 2026Evidence →
2. High, CVSS 8.64 Sep 2026

   SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725125659-1ca1c3c9d94b (pre-release) or later · < 0.0.0-20260725125659-1ca1c3c9d94b · CVE-2026-72795 · GHSA-h6w7-xxcf-w2mq · amended

   4 Sep 2026Evidence →
3. High, CVSS 8.64 Sep 2026

   SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725123945-77421530be4a (pre-release) or later · < 0.0.0-20260725123945-77421530be4a · CVE-2026-72794 · GHSA-34fj-mwm6-fjfg · amended

   4 Sep 2026Evidence →
4. Medium, CVSS 5.84 Sep 2026

   SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725122641-34be6c0bb073 (pre-release) or later · < 0.0.0-20260725122641-34be6c0bb073 · CVE-2026-72796 · GHSA-fgmr-7w36-9qfq · amended

   4 Sep 2026Evidence →
5. Medium, CVSS 5.84 Sep 2026

   SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724123622-8fb1b5766093 (pre-release) or later · < 0.0.0-20260724123622-8fb1b5766093 · CVE-2026-72797 · GHSA-f2rw-w22v-54vh · amended

   4 Sep 2026Evidence →
6. High, CVSS 8.64 Sep 2026

   SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724121519-426991d155c0 (pre-release) or later · < 0.0.0-20260724121519-426991d155c0 · CVE-2026-72798 · GHSA-mfrj-v65r-979c · amended

   4 Sep 2026Evidence →
7. Medium, CVSS 5.84 Sep 2026

   SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

   Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724112156-5bae0926b896 (pre-release) or later · < 0.0.0-20260724112156-5bae0926b896 · CVE-2026-72799 · GHSA-5w7r-f4cg-rqq7 · amended

   4 Sep 2026Evidence →
8. Medium, CVSS 4.34 Sep 2026

   SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

   crates.io surrealdb-core · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63733 · GHSA-66r2-5gwj-gxm2 · amended

   4 Sep 2026Evidence →
9. High, CVSS 8.14 Sep 2026

   SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

   crates.io surrealdb · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63735 · GHSA-848m-r628-vrxw · amended

   4 Sep 2026Evidence →
10. Low, CVSS 2.04 Sep 2026

    SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

    npm @simplewebauthn/server · Upgrade to 13.3.2 or later · <= 13.3.1 · GHSA-6hxq-p678-4hr2

    4 Sep 2026Evidence →
11. Medium, CVSS 5.84 Sep 2026

    SurrealDB allows bypass of deny-net flags via DNS resolution

    crates.io SurrealDB · Upgrade to 3.0.0-alpha.7 (pre-release), 2.3.6, 2.2.6 or 2.1.8 by release line · >= 2.1.0, < 2.1.8; >= 2.2.0, < 2.2.6; >= 3.0.0-alpha.1, < 3.0.0-alpha.7; >= 2.3.0, < 2.3.6 · CVE-2025-71390 · GHSA-m3c3-78fh-w3w7 · amended

    4 Sep 2026Evidence →
12. Unrated4 Sep 2026

    Double free / use-after-free in Chunk and InlineArray removal methods when an element's Drop panics

    crates.io imbl-sized-chunks · Upgrade to 0.2.0 or later · >= 0.0.0-0, < 0.2.0

    4 Sep 2026Evidence →
13. Medium, CVSS 5.83 Sep 2026

    SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724103335-f36331956ae9 (pre-release) or later · < 0.0.0-20260724103335-f36331956ae9 · CVE-2026-72800 · GHSA-5fhr-f75j-8wr9 · amended

    3 Sep 2026Evidence →
14. High, CVSS 7.53 Sep 2026

    SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724102025-3bc014c7dc32 (pre-release) or later · < 0.0.0-20260724102025-3bc014c7dc32 · CVE-2026-72801 · GHSA-8x84-r2ff-h8pq · amended

    3 Sep 2026Evidence →
15. Medium, CVSS 5.33 Sep 2026

    SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724095509-eee3410aa131 (pre-release) or later · < 0.0.0-20260724095509-eee3410aa131 · CVE-2026-72802 · GHSA-jv8v-xq2h-657v · amended

    3 Sep 2026Evidence →
16. Medium, CVSS 5.83 Sep 2026

    SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724093256-229fdffd7e4a (pre-release) or later · < 0.0.0-20260724093256-229fdffd7e4a · CVE-2026-72803 · GHSA-qvq9-hq6p-v378 · amended

    3 Sep 2026Evidence →
17. High, CVSS 8.63 Sep 2026

    SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724091654-82e9ded423e4 (pre-release) or later · < 0.0.0-20260724091654-82e9ded423e4 · CVE-2026-72804 · GHSA-vpjw-wf5h-cgpq · amended

    3 Sep 2026Evidence →
18. Medium, CVSS 5.83 Sep 2026

    SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723163028-931ba693375e (pre-release) or later · < 0.0.0-20260723163028-931ba693375e · CVE-2026-72805 · GHSA-67x2-mq63-v9vm · amended

    3 Sep 2026Evidence →
19. Medium, CVSS 5.83 Sep 2026

    SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723040913-768427f20f13 (pre-release) or later · < 0.0.0-20260723040913-768427f20f13 · CVE-2026-72806 · GHSA-6mcf-g667-w3qv · amended

    3 Sep 2026Evidence →
20. High, CVSS 8.03 Sep 2026

    SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723035036-0a176345e02a (pre-release) or later · < 0.0.0-20260723035036-0a176345e02a · CVE-2026-72807 · GHSA-x67c-8pwr-m8g3 · amended

    3 Sep 2026Evidence →
21. Medium, CVSS 5.83 Sep 2026

    SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031702-509b35055940 (pre-release) or later · < 0.0.0-20260723031702-509b35055940 · CVE-2026-72808 · GHSA-v7ph-r5r6-4jcj · amended

    3 Sep 2026Evidence →
22. High, CVSS 8.03 Sep 2026

    SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723031701-9c16e9851f0b (pre-release) or later · < 0.0.0-20260723031701-9c16e9851f0b · CVE-2026-72809 · GHSA-3mp7-4rh5-jrv9 · amended

    3 Sep 2026Evidence →
23. High, CVSS 8.63 Sep 2026

    SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723013612-ba948639d7f6 (pre-release) or later · < 0.0.0-20260723013612-ba948639d7f6 · CVE-2026-72810 · GHSA-mw8r-mw84-88v2 · amended

    3 Sep 2026Evidence →
24. Critical, CVSS 10.03 Sep 2026

    SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write…

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723004839-1a5b3431d5ab (pre-release) or later · < 0.0.0-20260723004839-1a5b3431d5ab · CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc · amended

    3 Sep 2026Evidence →
25. Medium, CVSS 6.53 Sep 2026

    SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

    Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260723002528-7d273c271ce1 (pre-release) or later · < 0.0.0-20260723002528-7d273c271ce1 · CVE-2026-72812 · GHSA-wgwx-479j-23vq · amended

    3 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.