CVE-2026-74800

CriticalCVSS 9.0/10Last modified Aug 26, 2026

Description

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-748018.2SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.ex CVE-2026-748028.2SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explic CVE-2026-7480310.0Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the CVE-2026-748049.3Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value CVE-2026-74815.4GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 t CVE-2026-74829.1Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker CVE-2026-7482010.0ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enabl CVE-2026-74838.5Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user.CVE-2026-748358.7The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 1 CVE-2026-748368.7Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unb CVE-2026-748378.7Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhau CVE-2026-74845.3External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Prop