Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700896 source statements · aliases may refer to the same vulnerability

GHSA-fm8w-2m5w-9j7rPublished

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

osv · BIT-cilium-2026-56743 · BIT-cilium-operator-2026-56743 · BIT-hubble-relay-2026-56743 · CVE-2026-56743

Go: github.com/cilium/cilium

MODERATESource modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6367Published

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium

osv · BIT-cilium-2026-56743 · BIT-cilium-operator-2026-56743 · BIT-hubble-relay-2026-56743 · CVE-2026-56743

Go: github.com/cilium/cilium

Source modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-7j72-f6wg-cxw6Published

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

osv · CVE-2026-68584 · GO-2026-6382

Go: github.com/siyuan-note/siyuan/kernel

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

CVE-2026-88279Published

GV-LPC2011/LPC2211 - ONVIF CreateUsers Username/Password Stack-Frame Overflow Denial of Service

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 4.9Source modified 10 Sep 2026Recorded 23 Oct 2026

GHSA-qvq9-hq6p-v378Published

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

osv · CVE-2026-72803 · GO-2026-6404

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-xp7j-h7jc-4w8pPublished

Semaphore U: OS Command Injection

osv · CVE-2026-73294 · CVE-2026-73682 · GO-2026-6435

Go: github.com/semaphoreui/semaphore

CRITICALSource modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6435Published

Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore

osv · CVE-2026-73294 · CVE-2026-73682 · GHSA-xp7j-h7jc-4w8p

Go: github.com/semaphoreui/semaphore

Source modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-mp7r-57w4-5qm3Published

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

osv · CVE-2026-72792 · GO-2026-6427

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-52gf-6rpq-fgmxPublished

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

osv · CVE-2026-73841 · GO-2026-6358

Go: github.com/openchoreo/openchoreo · Go: github.com/openchoreo/openchoreo

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-99rq-75j6-5j9fPublished

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

osv · CVE-2026-66394 · GO-2026-6364

Go: github.com/siyuan-note/siyuan/kernel

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6364Published

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-66394 · GHSA-99rq-75j6-5j9f

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-w878-pj84-3j5vPublished

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

osv · CVE-2026-67445 · GO-2026-6363

Go: github.com/axllent/mailpit

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-q2vg-7qgx-x5fcPublished

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

osv · CVE-2026-72811 · GO-2026-6402

Go: github.com/siyuan-note/siyuan/kernel

CRITICALSource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-75mr-qw9x-3r39Published

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

osv · CVE-2026-67446 · GO-2026-6359

Go: github.com/axllent/mailpit

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-pm3w-vxp9-ccwcPublished

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

osv · CVE-2026-68585 · GO-2026-6384

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 10 Sep 2026Recorded 24 Oct 2026

CVE-2026-87447Published

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-71805Published

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-…

cve-program ·

Vendor product: n/a

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-86600Published

Workload identity attestation generated before login host validation in Snowflake drivers

cve-program ·

https://pypi.org: snowflake-connector-python · https://pkg.go.dev: github.com/snowflakedb/gosnowflake · https://pkg.go.dev: github.com/snowflakedb/gosnowflake/v2

CVSS 3.1 8.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-71808Published

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including Merch…

cve-program ·

Vendor product: n/a

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-82533Published

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.6Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-88280Published

GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 4.9Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-36433Published

An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and RdiskUpgrade.exe components

cve-program ·

Vendor product: n/a

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28603Published

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges ne…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

GO-2026-6439Published

Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost

osv · CVE-2026-71493 · GHSA-mmg6-4qmv-6pc8

Go: github.com/infracost/infracost

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6440Published

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle

osv · CVE-2026-73087 · GHSA-p2w3-6x73-2f6x

Go: github.com/amir20/dozzle

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6428Published

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo

osv · CVE-2026-73842 · GHSA-rh53-xvx2-j327

Go: github.com/openchoreo/openchoreo

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6427Published

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72792 · GHSA-mp7r-57w4-5qm3

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6423Published

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72796 · GHSA-fgmr-7w36-9qfq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6437Published

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname in github.com/infracost/infracost

osv · CVE-2026-71494 · GHSA-6x6c-w9w9-hv4h

Go: github.com/infracost/infracost

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6424Published

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72793 · GHSA-h4v5-crx2-3cv4

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6407Published

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72804 · GHSA-vpjw-wf5h-cgpq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6434Published

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72789 · GHSA-v684-q882-jgmq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6350Published

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-59832 · GHSA-275h-v5h9-vr82

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6402Published

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6420Published

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72794 · GHSA-34fj-mwm6-fjfg

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6425Published

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72795 · GHSA-h6w7-xxcf-w2mq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6395Published

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72800 · GHSA-5fhr-f75j-8wr9

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6431Published

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72790 · GHSA-74pj-6g7r-j55c

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6415Published

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72798 · GHSA-mfrj-v65r-979c

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6408Published

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72812 · GHSA-wgwx-479j-23vq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6404Published

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72803 · GHSA-qvq9-hq6p-v378

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6388Published

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72806 · GHSA-6mcf-g667-w3qv

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6414Published

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72797 · GHSA-f2rw-w22v-54vh

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6406Published

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72808 · GHSA-v7ph-r5r6-4jcj

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6398Published

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72802 · GHSA-jv8v-xq2h-657v

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6387Published

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72805 · GHSA-67x2-mq63-v9vm

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6410Published

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72807 · GHSA-x67c-8pwr-m8g3

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6379Published

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-68586 · GHSA-36v8-mpjm-8j5r

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

GO-2026-6392Published

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking in github.com/siyuan-note/siyuan/kernel

osv · CVE-2026-72801 · GHSA-8x84-r2ff-h8pq

Go: github.com/siyuan-note/siyuan/kernel

Source modified 10 Sep 2026Recorded 24 Oct 2026

CVE-2026-88281Published

GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 4.9Source modified 10 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.