https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-26T19:57:19.516375+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116167 fkie_cve-2026-116167 2026-10-26T19:57:19.534408+00:00

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

 https://db.gcve.eu/vuln/ghsa-jvrf-pm5c-jgr4 GHSA-jvrf-pm5c-jgr4 2026-10-26T19:57:19.534481+00:00

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.