https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T21:25:37.628001+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-72795 fkie_cve-2026-72795 2026-10-03T21:25:37.655705+00:00

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.

 https://db.gcve.eu/vuln/ghsa-cjwm-9h7g-pcr9 Withdrawn: GHSA-cjwm-9h7g-pcr9 — Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private… 2026-10-03T21:25:37.655780+00:00

Withdrawn by the publisher.

Affected: Go: github.com/siyuan-note/siyuan/kernel

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h6w7-xxcf-w2mq. This link is maintained to preserve external references.

## Original Description SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.