rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-101091

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyu…

Description

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.

Scores

Severity
high
CVSS v2
8.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-101281

OpenDMARC versions up to 1.4.2 contain a flaw in the SPF Macro Handler that allows remote attackers to manipulate authentication, potentially enabling spoofed email delivery. The vulnerability can lead to improper mail-from domain verification. A patch is available to fix the issue.

View analysis

high

CVE-2026-101280

OpenDMARC versions up to 1.4.2 contain a remote authentication bypass that allows attackers to spoof domain validation. The flaw resides in the opendmarc_policy_query_dmarc function of the Multi-Record Set Handler. This can compromise email authentication for affected mail servers.

View analysis

high

CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

View analysis

high

CVE-2026-102243

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis