Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73609SiYuan before v3.7.4 Information Disclosure via getBookmarkLabelsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73608SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73607SiYuan before v3.7.4 Information Disclosure via getOutlineStorageGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73606SiYuan before v3.7.4 Information Disclosure via getRefIDsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73605SiYuan before v3.7.4 Path Traversal via getUniqueFilenameGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73501kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc DefaultGo · github.com/getkin/kin-openapi · fixed in 0.144.0
- CVE-2026-73500etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineGo · go.etcd.io/etcd/client/pkg/v3, go.etcd.io/etcd/v3 · fixed in 3.5.33, 3.6.14, 3.7.1
- CVE-2026-73499etcd: Watch API authorization bypass via open-ended range requestsGo · go.etcd.io/etcd/server/v3, go.etcd.io/etcd/v3 · fixed in 3.5.33, 3.6.14, 3.7.1
- CVE-2026-72809SiYuan before v3.7.4 Authentication Bypass via Localhost TrustGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723031701-9c16e9851f0b
- CVE-2026-72808SiYuan before v3.7.4 Information Disclosure via getFileAnnotationGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723031702-509b35055940
- CVE-2026-72807SiYuan before v3.7.4 SQL Injection via queryBlocks templateGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723035036-0a176345e02a
- CVE-2026-72806SiYuan before v3.7.4 Authentication Bypass via Attribute ViewGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723040913-768427f20f13
- CVE-2026-72805SiYuan before v3.7.4 Information Disclosure via Block EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723163028-931ba693375e
- CVE-2026-72804SiYuan before v3.7.4 Authentication Bypass via Graph EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724091654-82e9ded423e4
- CVE-2026-72803SiYuan before v3.7.4 Information Disclosure via getBlockAttrsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724093256-229fdffd7e4a
- CVE-2026-72802SiYuan before v3.7.4 Information Disclosure via resolveAssetPathGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724095509-eee3410aa131
- CVE-2026-72801SiYuan before v3.7.4 Information Disclosure via Encryption Key MaterialGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724102025-3bc014c7dc32
- CVE-2026-72800SiYuan before v3.7.4 Information Disclosure via Unfiltered APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724103335-f36331956ae9
- CVE-2026-72799SiYuan before v3.7.4 Information Disclosure via Path ResolutionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724112156-5bae0926b896
- CVE-2026-72798SiYuan before v3.7.4 Information Disclosure via renderAttributeViewGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724121519-426991d155c0
- CVE-2026-72797SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatusGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724123622-8fb1b5766093
- CVE-2026-72796SiYuan before v3.7.4 Access Control Bypass via Static RoutesGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725122641-34be6c0bb073
- CVE-2026-72795SiYuan before v3.7.4 Information Disclosure via Embed BlockGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725125659-1ca1c3c9d94b
- CVE-2026-72794siyuan before v3.7.4 Session Cookie Key Disclosure via getConfGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725123945-77421530be4a
- CVE-2026-72793SiYuan before v3.7.4 Information Disclosure via /api/system/getConfGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725132049-2d8b98395a91
- CVE-2026-72792SiYuan before v3.7.4 Information Disclosure via Tag APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726002639-4515fa257cfa
- CVE-2026-72791SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViewsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726004013-64c26e74bb82
- CVE-2026-72790SiYuan before v3.7.4 Information Disclosure via getNotebookInfoGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726005141-9edb321eb451
- CVE-2026-72789SiYuan before v3.7.4 Authentication Bypass via Encrypted NotebooksGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726020813-a25c2dd06aae
- CVE-2026-72788SiYuan before v3.7.4 Information Disclosure via UILayout FilterGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2