<span class="text-transparent bg-clip-text bg-gradient-to-r from-brand-purple via-brand-blue to-brand-green">Blog

BREAKING: CVE-2026-73043 - SiYuan Template Calculation RCE in Desktop Client

CVE-2026-73043 is a critical SiYuan flaw where unsanitized database Template calculation output reaches Electron innerHTML and can become OS command execution. Upgrade to 3.7.4 or later.

BREAKING: CVE-2026-73046 - SiYuan Basic Auth Lockout Bypass Enables Admin Brute Force

CVE-2026-73046 is a CVSS 9.8 flaw in SiYuan that lets remote attackers bypass CAPTCHA and lockout controls through HTTP Basic Auth and brute-force the admin access code. Upgrade to 3.8.0 or later.

BREAKING: CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover

CVE-2026-19598 is a CVSS 9.8 authorization bypass in the Pods WordPress plugin that lets unauthenticated attackers reach admin methods and take over sites. Update to 3.3.9.1.

BREAKING: CVE-2026-18549 - @fastify/multipart Aborted Upload DoS

CVE-2026-18549 lets unauthenticated clients leak temp files and hang request handlers in @fastify/multipart <10.1.1, causing disk and event-loop exhaustion. Upgrade to 10.1.1.

CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash

CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.

CVE-2026-9318: tablib Stored XSS via HTML Export Dataset Title

tablib, a Python tabular data library with over 147 million PyPI downloads, contains a stored cross-site scripting vulnerability in its HTML export functionality. Attackers can embed JavaScript payloads in dataset titles that execute when the exported HTML file is opened in a browser. Fixed in version 3.10.0.

CVE-2026-72880: Dokploy Certificate Path Traversal Enables Arbitrary File Write and Remote Code Execution

Dokploy prior to 0.29.13 accepts a user-supplied certificatePath without confinement, allowing authenticated users to write files to arbitrary host locations and achieve remote code execution. Fixed in 0.29.13.

CVE-2026-72693: kbd openvt Privilege Escalation Enables Passwordless Root Login

The kbd package, shipped on virtually every Linux distribution, contains a local privilege escalation in openvt -u. A flaw in how authenticate_user() verifies process ownership lets an unprivileged user trigger a passwordless login -f root on a new virtual terminal.

CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files

Hugging Face Accelerate through 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes, allowing arbitrary file reads and denial of service via named pipes. Affects 27M monthly downloads.

CVE-2026-66763: SAP BusinessObjects CMS Stores Credentials Behind a Hardcoded Cryptographic Key

SAP BusinessObjects BI Platform CMS encrypts sensitive credentials with a hardcoded cryptographic key baked into the source code. Anyone with high privileges and local server access can extract and decrypt every stored password.

CVE-2026-52855: Pterodactyl Wings Leaks Daemon Configuration Secrets via Egg Templates (CVSS 9.9)

Pterodactyl Wings exposes its entire daemon configuration through egg configuration-file templating, leaking API keys, SFTP credentials, and database connection strings. CVSS 9.9. Fixed in version 1.12.3.

CVE-2026-44763: Path Traversal in SAP MII Writes Files Outside Intended Directories

SAP Manufacturing Integration and Intelligence fails to validate file paths in certain functions. A privileged attacker can write files outside the intended directory, with high impact across confidentiality, integrity, and availability.