Veille CVE

Lundi 12 octobre 2026

3 CVE sur 5

Critique 1 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « kernel » ✕
  1. CVE-2026-109310 6.5 Moyenne

    siyuan-note siyuan

    SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

  2. CVE-2026-109309 6.5 Moyenne

    siyuan-note siyuan

    SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

  3. CVE-2026-87765 5.5 Moyenne

    Unisoc (Shanghai) Technologies Co., Ltd. kernel

    In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.