All CVEs — page 52 of 242

The complete archive, 25 per page, newest first. 6034 records. Search instead.

• HIGH 8.8CVE-2026-100639public exploit available2026-09-26

  The flaw allows an attacker to inject arbitrary attributes into HTML content, leading to potential remote code execution when the affected control receives focus in the SiYuan application.

• HIGH 7.6CVE-2026-100638public exploit available2026-09-26
• HIGH 7.6CVE-2026-100637public exploit available2026-09-26
• HIGH 7.6CVE-2026-100636public exploit available2026-09-26
• MEDIUM 5.9CVE-2026-100635public exploit available2026-09-26
• MEDIUM 4.7CVE-2026-100634public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100633public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100632public exploit available2026-09-26
• HIGH 7.5CVE-2026-100631public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100630public exploit available2026-09-26
• MEDIUM 5.5CVE-2026-100629public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100628public exploit available2026-09-26
• HIGH 8.1CVE-2026-100627public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100626public exploit available2026-09-26
• HIGH 7.1CVE-2026-100625public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100624public exploit available2026-09-26
• HIGH 8.8CVE-2026-100623public exploit available2026-09-26

  This flaw allows an authenticated admin to bypass the normal membership workflow and directly add any user as an admin in their organization, potentially granting unauthorized access.

• HIGH 7.5CVE-2026-100622public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100621public exploit available2026-09-26
• LOW 3.8CVE-2026-100620public exploit available2026-09-26
• HIGH 8.8CVE-2026-100619public exploit available2026-09-26

  The flaw allows an attacker with certain API keys or write permissions to inject malicious files into the manifest, potentially leading to OTA manifest poisoning.

• HIGH 8.5CVE-2026-100618public exploit available2026-09-26
• HIGH 8.8CVE-2026-100617public exploit available2026-09-26

  The flaw allows authenticated app/org admins to grant channel permissions to non-member users, enabling attackers with admin privileges to bypass organization membership checks and grant unauthorized access.

• MEDIUM 5.5CVE-2026-100616public exploit available2026-09-26
• HIGH 8.8CVE-2026-100615public exploit available2026-09-26

  The flaw allows an apikey_manager to rotate a higher-privileged org_super_admin API key, leading to credential recovery. This matters because it enables privilege escalation and unauthorized access.