漏洞公告

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

adm-zip: Crafted ZIP file triggers 4GB memory allocation

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Duplicate Advisory: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

decompress allows arbitrary hardlink creation during archive extraction

Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

Tesla vulnerable to atom exhaustion via untrusted URL scheme

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Tesla has decompression bomb on response body

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

GoBGP confederation validation panics on empty AS_PATH attribute