https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T08:15:25.888946+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-74800 fkie_cve-2026-74800 2026-10-03T08:15:25.890105+00:00

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

 https://db.gcve.eu/vuln/ghsa-v4hj-628x-hq5x GHSA-v4hj-628x-hq5x 2026-10-03T08:15:25.890179+00:00

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.