https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T08:00:08.756583+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-93921 fkie_cve-2026-93921 2026-10-04T08:00:08.758351+00:00

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

 https://vulnerability.circl.lu/vuln/ghsa-j5v6-qhh5-48r7 GHSA-j5v6-qhh5-48r7 2026-10-04T08:00:08.758440+00:00

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.