{"vulnerability": "CVE-2026-7360", "sightings": [{"uuid": "2140e44d-e1c0-440d-991d-8333b6244f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7360", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260429", "content": "", "creation_timestamp": "2026-04-28T20:00:00.000000Z"}, {"uuid": "ef6c8934-65b1-4d5d-89fa-2774f4474eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7360", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mklwel5g7v2v", "content": "", "creation_timestamp": "2026-04-29T01:15:33.866125Z"}, {"uuid": "1c02bf46-ee48-44fa-b395-5ea3348f2e6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7360", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260504", "content": "", "creation_timestamp": "2026-05-03T18:00:00.000000Z"}, {"uuid": "08a88d1f-c494-493d-88c6-2a097783af21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73601", "type": "seen", "source": "https://www.acn.gov.it/portale/w/flowise-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-08-17T16:45:16.848205Z"}, {"uuid": "0d9ed918-41c5-4ca9-bc2c-f1ec32f49e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73602", "type": "seen", "source": "https://www.acn.gov.it/portale/w/flowise-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-08-17T16:45:19.101764Z"}, {"uuid": "ab588f6e-8cc6-4533-accc-33aeb65c0db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73603", "type": "seen", "source": "https://www.acn.gov.it/portale/w/flowise-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-08-17T16:45:21.322187Z"}, {"uuid": "9af7f7f6-1458-408b-b118-c5dd7cbdde2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73604", "type": "seen", "source": "https://www.acn.gov.it/portale/w/flowise-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-08-17T16:45:23.565841Z"}, {"uuid": "9d178699-37b9-4914-a46f-6e3039c9a5b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73601", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4pk55rpd2b", "content": "CVE-2026-73601\nFlowise versions before 3.1.3 are vulnerable to unauthorized code execution. This means attackers can run malicious commands on your server. To stay safe, update to Flowise 3.1.3 or later.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T12:50:04.169097Z"}, {"uuid": "811e4647-b3e1-431b-8976-d091677acadb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73602", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4pk5prrp2c", "content": "CVE-2026-73602\nFlowise, a software used to create interactive diagrams, has a security flaw that allows attackers to execute unauthorized code on the system. This could lead to data theft or system compromise if an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T12:50:04.768539Z"}, {"uuid": "b77b8510-288c-4a65-b5de-b62ca5d37f64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73601", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxrxmo2ij2e", "content": "CVE-2026-73601 - flowise\nFlowise versions before 3.1.3 have a security issue that allows authorized users to run unauthorized commands on the server. This is a serious problem because it could be used to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-08-13T13:50:14.630093Z"}, {"uuid": "36111143-3b24-415e-8e58-2dccea31a39c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73602", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxsjhygmn2m", "content": "CVE-2026-73602 - flowise\nFlowise versions before 3.1.3 have a security flaw that allows attackers to run unauthorized code on the system. This could potentially lead to data breaches or system compromise.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "creation_timestamp": "2026-08-13T14:00:04.626876Z"}, {"uuid": "9d7c6566-a6ee-46aa-ad59-ff05d4320fbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73608", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxsjjfi3v25", "content": "CVE-2026-73608 - siyuan\nAn issue in SiYuan's development branch allows anyone to access sensitive data that should be restricted to authorized users. This affects users of the development version of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-13T14:00:05.997051Z"}, {"uuid": "bd87d5be-3842-483f-90f6-4058791586cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73602", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3mux5uvfrgn23", "content": "A critical-severity fix just shipped for Flowiseai Flowise. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-73602", "creation_timestamp": "2026-09-07T18:41:02.573040Z"}, {"uuid": "44547a68-a4e8-4b61-8649-6ab0a726fb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73605", "type": "seen", "source": "https://gist.github.com/alon710/22096450d45afa6904ca64bbc851447c", "content": "# CVE-2026-73605: CVE-2026-73605: Path Traversal and File Existence Oracle via getUniqueFilename Endpoint in SiYuan\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73605\n\n## Summary\nAn authorization bypass and path traversal vulnerability exists in the SiYuan knowledge workspace platform. The vulnerability is located in the '/api/file/getUniqueFilename' endpoint inside the 'github.com/siyuan-note/siyuan/kernel' package. Under default configurations, this route is exposed to users who satisfy basic authentication middleware checks, which includes anonymous readers in publish mode. By supplying unvalidated absolute paths, remote attackers can verify the existence of files and directories across the host operating system, establishing a high-fidelity file existence oracle.\n\n## TL;DR\nUnauthenticated remote users can verify the existence of files and folders on the host operating system by sending crafted path parameters to the SiYuan file utility endpoint, leading to sensitive host system information disclosure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Base Score**: 6.9\n- **EPSS Score**: 0.00325 (Percentile: 23.19%)\n- **Impact**: Filesystem structure reconnaissance\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Restrict access to the SiYuan API via network access control lists\n- Disable anonymous publish mode if not strictly required\n\n**Remediation Steps:**\n1. Identify all active instances of SiYuan running versions prior to v3.7.4\n2. Apply the v3.7.4 update from the official source\n3. Verify that the /api/file/getUniqueFilename endpoint no longer accepts absolute paths outside the workspace\n\n## References\n\n- [NVD - CVE-2026-73605](https://nvd.nist.gov/vuln/detail/CVE-2026-73605)\n- [CVE.org - CVE-2026-73605](https://www.cve.org/CVERecord?id=CVE-2026-73605)\n- [GitHub Security Advisory GHSA-hf8h-97gm-4x2p](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hf8h-97gm-4x2p)\n- [VulnCheck Advisory Portal](https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-getuniquefilename)\n- [SiYuan Repository](https://github.com/siyuan-note/siyuan)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73605) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T16:30:30.000000Z"}, {"uuid": "d64623e4-be89-471f-ab6b-bf35bf04cdf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73605", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-hf8h-97gm-4x2p", "content": "", "creation_timestamp": "2026-10-01T15:46:01.000000Z"}, {"uuid": "7a1521c6-4747-41f9-b4ea-3c8f918a23c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73607", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-53fp-9jmv-227g", "content": "", "creation_timestamp": "2026-10-01T15:44:46.000000Z"}, {"uuid": "79d9189e-662b-470a-8b60-466588d5ca60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73606", "type": "seen", "source": "https://gist.github.com/alon710/7d7216991d5991995a78544517969a95", "content": "# CVE-2026-73606: CVE-2026-73606: Authorization Bypass and Information Disclosure in SiYuan /api/block/getRefIDs Endpoint\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73606\n\n## Summary\nAn authorization bypass and information disclosure vulnerability in the SiYuan personal knowledge management system before version 3.7.4 allows unauthenticated attackers to query block relationship metadata from password-protected documents.\n\n## TL;DR\nUnauthenticated API requests to `/api/block/getRefIDs` bypass password checks, leaking relationship hierarchies in SiYuan.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00325 (Percentile: 23.20%)\n- **Exploit Status**: None (No public exploit)\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: kernel/api/block.go (/api/block/getRefIDs)\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan kernel to v3.7.4 or later.\n- Disable anonymous publish mode if immediate upgrade is not feasible.\n- Enforce IP-level access controls to the SiYuan kernel api endpoint.\n\n**Remediation Steps:**\n1. Verify the currently deployed SiYuan version.\n2. Update deployment configurations (Docker Compose, systemd, or native binaries) to reference v3.7.4 or later.\n3. Test endpoint response behavior by issuing unauthenticated POST requests to /api/block/getRefIDs to confirm password-protected paths return filtered results.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vg99-7gj7-2fr5)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getrefids)\n- [NIST National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-73606)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-73606)\n- [SiYuan Repository](https://github.com/siyuan-note/siyuan)\n- [SiYuan v3.8.0 Release Notes](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73606) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T17:30:31.000000Z"}, {"uuid": "2d74c831-f206-430c-8840-de186039d2b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73606", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-vg99-7gj7-2fr5", "content": "", "creation_timestamp": "2026-10-01T16:29:35.000000Z"}, {"uuid": "10bfa52c-a622-4165-b2c3-028636e98084", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73609", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-j4ph-9xwf-wcj4", "content": "", "creation_timestamp": "2026-10-01T16:23:37.000000Z"}, {"uuid": "c7d3500b-2d38-4297-ba09-00cdd8cffea5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73609", "type": "seen", "source": "https://gist.github.com/alon710/78ce2182a966596104e43c4f25489270", "content": "# CVE-2026-73609: CVE-2026-73609: Missing Authorization in SiYuan Note getBookmarkLabels Endpoint\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73609\n\n## Summary\nAn information disclosure vulnerability (CWE-862) in the SiYuan Note platform before version v3.7.4 allows anonymous or unprivileged readers to obtain a complete list of bookmark labels globally across all workspaces and notebooks by querying the `/api/attr/getBookmarkLabels` API endpoint.\n\n## TL;DR\nMissing authorization checks on the `/api/attr/getBookmarkLabels` endpoint in SiYuan Note allow unauthenticated or unprivileged users to query and retrieve all bookmark labels across the entire workspace, exposing confidential project names, structures, and metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.8\n- **CVSS v4.0**: 6.9\n- **EPSS Score**: 0.00325 (0.33%)\n- **Exploit Status**: Conceptual Proof of Concept\n\n## Affected Systems\n\n- SiYuan Note\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or later\n- Bind Siyuan Note server strictly to localhost loopback interface (127.0.0.1)\n- Restrict endpoint access using Nginx or other reverse proxies to filter path /api/attr/getBookmarkLabels\n\n**Remediation Steps:**\n1. Identify the current running version of Siyuan Note.\n2. Download the updated version (v3.7.4 or later) from the official GitHub repository.\n3. Apply the update and restart the server.\n4. Validate the fix by attempting an unauthenticated POST request to /api/attr/getBookmarkLabels.\n\n## References\n\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-73609)\n- [GitHub Security Advisory (GHSA)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73609) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T20:30:31.000000Z"}, {"uuid": "6a008d41-bae6-4c78-a154-6e382a2c79ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73607", "type": "seen", "source": "https://gist.github.com/alon710/d5fa4fcd1dad3964c1d3e73bdba0732b", "content": "# CVE-2026-73607: CVE-2026-73607: Missing Authorization in SiYuan /api/storage/getOutlineStorage Leads to Information Disclosure\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73607\n\n## Summary\nAn architectural evaluation of CVE-2026-73607 in the SiYuan personal knowledge management system. This technical advisory details a Missing Authorization (CWE-862) vulnerability in the Go-based backend kernel, specifically within the outline storage API endpoint. Under certain configurations, authenticated low-privilege users can query metadata, heading structures, and block hierarchies of restricted documents.\n\n## TL;DR\nA Broken Object Level Authorization (BOLA) vulnerability in SiYuan prior to v3.7.4 allows authenticated users to extract document outlines and structural metadata of unauthorized notes via the `/api/storage/getOutlineStorage` API endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 / v4.0**: 5.8 (Medium) / 6.9 (Medium)\n- **EPSS Score**: 0.00325 (Percentile: 23.20%)\n- **Impact**: Information Disclosure (Confidentiality: Low)\n- **Exploit Status**: PoC Available / No Active Exploitation\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: >= 0, < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to v3.7.4 or later\n- Implement network-level segmentation to restrict API access\n- Restrict user creation and guest access on server-mode instances\n\n**Remediation Steps:**\n1. Verify the currently running version of the SiYuan kernel by inspecting the application logs or interface settings.\n2. Download the latest stable release (v3.8.0 or newer) from the official repository.\n3. Replace the old executable or container image with the updated version.\n4. Restart the SiYuan service and monitor authentication logs for standard API requests.\n\n## References\n\n- [GitHub Security Advisory (GHSA-53fp-9jmv-227g)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-73607)\n- [Official Patch Release Tag (v3.8.0)](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73607) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T21:30:31.000000Z"}]}