{"vulnerability": "cve-2026-7305", "sightings": [{"uuid": "f1335c01-eeb5-4e2c-8826-3a074004c9e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73055", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt77z2t6wa2m", "content": "CVE-2026-73055\nShescape, a tool used on Unix systems, fails to properly protect user data. This means an attacker could potentially find out a user's home directory location. To fix this, update to version 2.1.15 or later.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-16T12:50:17.716534Z"}, {"uuid": "e58c7d25-b3d2-4d0e-9da3-5675ae71da0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73056", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117105428138280687", "content": "siyuan-note siyuan (kernel <3.7.4) hit by CRITICAL vuln: CVE-2026-73056 allows unlimited API token brute-forcing via CheckAuth(). Weak tokens = full admin takeover. Update & review tokens! \ud83d\udd11 https://radar.offseq.com/threat/cve-2026-73056-improper-restriction-of-excessive-authentication-attempts-in-siyuan-note-siyuan-28d3540593a8ef28 #OffSeq #CVE202673056 #infosec", "creation_timestamp": "2026-08-16T13:30:26.700592Z"}, {"uuid": "f35d632c-ebe5-48ad-8552-eeaec6a88d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73056", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mt7cbccnrj24", "content": "CRITICAL vuln in siyuan-note siyuan: CVE-2026-73056 lets remote attackers brute-force API tokens for admin access. Use strong tokens & update kernel ASAP. Details: https://radar.offseq.com/threat/cve-2026-73056-improper-restriction-of-excessive-authentication-attempts-in-siyuan-note-siyuan-28d354...", "creation_timestamp": "2026-08-16T13:30:28.586185Z"}, {"uuid": "93cc40eb-0a33-4e6c-8fcd-96aedad72cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73056", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt7degcjd22e", "content": "CVE-2026-73056 - siyuan\nOld versions of the SiYuan kernel have a weakness in how they handle API tokens. This makes it easy for an attacker to try many different tokens until they find the right one. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-16T13:50:06.756596Z"}, {"uuid": "e01992f1-2905-44dc-9ee1-3bce3934b023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73056", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mt7kzigj3n2b", "content": "\ud83d\udea8 CVE-2026-73056 \u2014 CVSS 9.3 CRITICAL\n\nSiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-73056\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-16T16:07:20.338290Z"}, {"uuid": "68518e25-b284-44ef-ad43-bc6c46403d6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73056", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtaj2cal3p26", "content": "CVE-2026-73056 - Critical auth bypass in SiYuan kernel <3.7.4. Unauthenticated attackers can brute-force API tokens via CheckAuth() middleware, no lockout. CVSS 9.8. Update immediately. #CVE #SiYuan #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-73056/", "creation_timestamp": "2026-08-17T01:04:29.239884Z"}, {"uuid": "efed15a3-725c-4ca9-8bc9-8ae137e62fee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73056", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117108157232824630", "content": "CVE-2026-73056 - Critical auth bypass in SiYuan kernel <3.7.4. Unauthenticated attackers can brute-force API tokens via CheckAuth() middleware, no lockout. CVSS 9.8. Update immediately. #CVE #SiYuan #infosec\nhttps://www.valtersit.com/cve/CVE-2026-73056/", "creation_timestamp": "2026-08-17T01:04:38.232060Z"}, {"uuid": "81af278d-9e81-40e0-94c5-b3f86e9ccc65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73052", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt5rntbcd32u", "content": "CVE-2026-73052 - siyuan\nSiYuan's sort menu is vulnerable to JavaScript injection, which can allow attackers to execute code when users open the menu. This is a concern for organizations using SiYuan, as it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-15T23:00:35.366969Z"}, {"uuid": "231651a3-b66c-42e6-9396-ebcfd0be61b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73052", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5ro6ib3k2b", "content": "\ud83d\udd34 CVE-2026-73052 - Critical (9)\n\nSiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates the...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73052/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-15T23:00:48.006314Z"}, {"uuid": "8770c55f-7a13-4124-856b-a723390e31fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73053", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5rofofwi2l", "content": "\ud83d\udd34 CVE-2026-73053 - Critical (9)\n\nSiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji f...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73053/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-15T23:00:55.308515Z"}, {"uuid": "aa2f61c3-a50e-4862-8882-5dddb951ba28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73054", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5romoh3m26", "content": "\ud83d\udfe0 CVE-2026-73054 - High (7.5)\n\nSiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket end...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73054/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-15T23:01:03.176176Z"}, {"uuid": "1d0bb001-cbef-4ba0-8ab4-1c07e44c255f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73050", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt5s6sffiv2p", "content": "CVE-2026-73050 - siyuan\nSiYuan, a database management software, has a security flaw that can allow attackers to inject malicious code into the software. This can happen when a database contains malicious\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-15T23:10:04.807318Z"}, {"uuid": "1d14df5b-be94-4b40-8440-9b42b31bf3fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73053", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt5s6twgr42y", "content": "CVE-2026-73053 - siyuan\nSiYuan versions before v3.7.4 have a security flaw that allows attackers to create malicious document icons. These icons can execute code on the host system if Node integration is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-15T23:10:07.440016Z"}, {"uuid": "b01e8723-23bc-4f65-8ed7-cdded432a360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73055", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt5sqnsrdp2p", "content": "CVE-2026-73055 - shescape\nThe Shescape tool on Unix systems with BusyBox may reveal your home directory location to an attacker. This is a concern if you use Shescape with untrusted input. To fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#shescape #ericcornelissen #CVE #infosec", "creation_timestamp": "2026-08-15T23:20:04.009162Z"}, {"uuid": "55953aff-74ab-4c8a-81e2-f8618c89638a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73055", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117102243668854766", "content": "CVE-2026-73055: CRITICAL vuln in ericcornelissen shescape (<2.1.15, 3.0.0<3.0.2). Improper tilde (~) escaping lets attackers leak home dir & alter cmd targets on BusyBox /bin/sh. Avoid untrusted input in escape APIs. Patch pending. https://radar.offseq.com/threat/cve-2026-73055-improper-encoding-or-escaping-of-output-in-ericcornelissen-shescape-3ef90f5f16672f7b #OffSeq #CVE202673055 #infosec", "creation_timestamp": "2026-08-16T00:00:39.624679Z"}, {"uuid": "e5b5445b-a19d-48ca-a616-cdbe62d578c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73055", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mt5uz67kqo2w", "content": "CRITICAL: ericcornelissen shescape before 2.1.15 & 3.0.2 lets attackers leak home dir & change cmd ops via tilde (~) injection. Avoid using escape APIs with untrusted input until patched. https://radar.offseq.com/threat/cve-2026-73055-improper-encoding-or-escaping-of-output-in-ericcornelissen-she...", "creation_timestamp": "2026-08-16T00:00:37.593279Z"}, {"uuid": "ac1aaf56-75de-4e23-ab0c-aee357cf0929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73050", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5uzlhyl72m", "content": "\ud83d\udd34 CVE-2026-73050 - Critical (9)\n\nSiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73050/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-16T00:00:52.070110Z"}, {"uuid": "ed735cab-214b-4994-8e37-91ff822767ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73055", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mt5yrlc6572z", "content": "Tiny BusyBox Leak, Massive Bureaucratic Coma, Everyone Pretends It Is Fine\nPANIC 18% | Lag 0.0h | CVE-2026-73055 affects Shescape on Unix systems using BusyBox and may expose a user's home directory\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-16T01:07:57.676535Z"}, {"uuid": "8dd1c70e-cb4d-485e-9e80-fbfd394486b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73053", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117102950741905319", "content": "CVE-2026-73053: CRITICAL XSS in SiYuan (pre-v3.7.4) risks code execution on host via crafted icons when Node integration is enabled. No patch confirmed \u2014 disable Node integration or avoid untrusted files. https://radar.offseq.com/threat/cve-2026-73053-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-1654398c24cf93d4 #OffSeq #XSS #Vuln #SiYuan", "creation_timestamp": "2026-08-16T03:00:24.940233Z"}, {"uuid": "71e6bdbe-496c-4e33-8387-30c09d519fb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73053", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mt672pkueq2f", "content": "SiYuan (pre-v3.7.4) hit by CRITICAL XSS (CVE-2026-73053). Crafted icons can execute code if Node integration is enabled. Patch status unclear \u2014 disable Node integration to reduce risk. https://radar.offseq.com/threat/cve-2026-73053-improper-neutralization-of-input-during-web-page-generation-cross...", "creation_timestamp": "2026-08-16T03:00:26.672103Z"}, {"uuid": "9ab7605b-8898-453e-93b8-273fdd5987ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73052", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117103304584954863", "content": "CVE-2026-73052: CRITICAL XSS in SiYuan (<3.7.4) enables arbitrary JS & potential code execution if Node integration is enabled. Desktop users most at risk \u2014 upgrade ASAP & disable Node integration where possible. https://radar.offseq.com/threat/cve-2026-73052-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-c5f0eb8b5e84714b #OffSeq #XSS #SiYuan #Infosec", "creation_timestamp": "2026-08-16T04:30:23.963498Z"}, {"uuid": "5f0574b2-27d8-41fc-b809-23bf9edb092c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-73052", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mt6e3mlhur2n", "content": "SiYuan (<3.7.4) hit by CRITICAL XSS (CVE-2026-73052). Desktop clients with Node integration risk code execution. Upgrade to 3.7.4+ & review Node settings. https://radar.offseq.com/threat/cve-2026-73052-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-c5f0eb8b5e8...", "creation_timestamp": "2026-08-16T04:30:25.867519Z"}]}