Open Source Vulnerabilities

github.com/siyuan-note/siyuan/kernel

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode) in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel

github.com/googleapis/mcp-toolbox

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password in github.com/siyuan-note/siyuan/kernel

github.com/openchoreo/openchoreo

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo

github.com/siyuan-note/siyuan/kernel

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel

code.gitea.io/gitea, gitea.dev

Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev

github.com/siyuan-note/siyuan/kernel

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel

github.com/semaphoreui/semaphore

Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore

github.com/infracost/infracost

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname in github.com/infracost/infracost

github.com/infracost/infracost

Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost

github.com/amir20/dozzle

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle

Traefik HTTP/3 Backend NTLM Connection Reuse

AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

envoy-gateway-fips-1.7-egctl

crossplane-cli-fips-2.3

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

chartmuseum, chartmuseum

dogstatsd-7.81, dogstatsd-7.81

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

datadog-agent-fips-7.81

datadog-agent-fips-7.81

datadog-agent-fips-7.81

datadog-agent-7.76, datadog-agent-7.76

Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

Traefik entrypoint header-name sanitization bypassed via request trailers

docker-compose-fips

dogstatsd-7.81, dogstatsd-7.81

nodemailer

TuxCare security update for nodemailer (7 CVEs)

consul-k8s-1.3-cli