CVE Vulnerability Catalog

A vulnerability in SiYuan before version 3.7.0 allows JavaScript injection via a crafted cell value in the attribute-view (database) renderer. An attacker with write access to a synced workspace can plant malicious content that executes arbitrary JavaScript when the victim opens the block-attribute panel. On Electron desktop with nodeIntegration enabled, this XSS can escalate to remote code execution (RCE) via require('child_process').

A vulnerability in SiYuan before version 3.7.0 allows JavaScript execution in the administrator's context by rendering a Bazaar package README. The flaw stems from an incomplete allowlist of event attributes in the lute sanitizer engine, which passes modern event handlers (e.g., onpointerover, onpointerdown) through.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, allowing RoleAdministrator access to every installed browser extension without authentication.

SiYuan is a knowledge management system that prior to version 3.7.0 had the /api/icon/getDynamicIcon endpoint which did not require authentication. Attackers can exploit this endpoint to execute arbitrary SELECT queries against the SiYuan SQLite database, leading to data leakage.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, a CSS snippet body containing </style> breaks out of its surrounding <style> tag, allowing arbitrary JavaScript execution in the renderer. On Electron desktop builds, the renderer runs with nodeIntegration:true, enabling access to require('child_process') from the injected handler, leading to remote code execution (RCE).

SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, a vulnerability allowed an unauthenticated attacker to read arbitrary files in WorkspaceDir by double URL-encoding in the /assets/*path route.

Vulnerability in Chrome DevTools MCP (versions 0.24.0 to 1.1.0) allows bypassing workspace root restrictions via symbolic links. The path validation function does not canonicalize symbolic links, enabling read and write access to files outside the allowed area.

A vulnerability in chrome-devtools-mcp from version 0.20.0 to 1.1.0 allows a local low-privilege user to create a symbolic link to the daemon PID file, resulting in overwriting any victim's file with the daemon PID string.

Sentry is an error tracking and performance monitoring tool. From version 24.4.0 to 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, there is a stored cross-site scripting (XSS) vulnerability in the Attribute View asset cell renderer that can escalate to remote code execution (RCE) in the Electron desktop client.

Appsmith before version 2.1 exposes the supervisord XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup.

In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.

A vulnerability in Tiptap for PHP before version 2.1.1 allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string. This triggers an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(), potentially corrupting records and permanently crashing the HTML rendering pipeline for all viewers.

CVE ID CVE-2026-47093 has been rejected or withdrawn by its CVE Numbering Authority.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the html_auth_footer, which has been fixed in version 1.2.31.

In Cacti versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. When the server locale uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes '1,5', while RRDtool expects a dot. This causes metric data to shift into wrong columns or be silently dropped.

In Cacti versions 1.2.30 and prior, the rfilter request variable was concatenated into an RLIKE SQL clause without sanitization. The vulnerability allows pre-auth SQL Injection (SQLi) if guest graph viewing is enabled. The issue was fixed in version 1.2.31.

A vulnerability in GIMP allows remote code execution via a heap-based buffer overflow when parsing HDR files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) has an unbounded loop in pl011_irq_tx_enable() that hangs the thread when CTS hardware flow control is enabled and the peer de-asserts CTS. The loop never exits because the TX FIFO cannot drain, causing a denial of service (CWE-835).

A vulnerability in MosaicML Composer allows remote code execution through the deserialization of untrusted data. User interaction is required to exploit this vulnerability, meaning the victim must visit a malicious page or open a malicious file.