Go - OSV

GHSA-rh53-xvx2-j327

Go/github.com/openchoreo/openchoreo

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation 8 hours ago

Fix available
Severity - 9.0 (Critical)

GHSA-mp7r-57w4-5qm3

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password 9 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-h4v5-crx2-3cv4

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers 9 hours ago

Fix available
Severity - 8.6 (High)

GHSA-h6w7-xxcf-w2mq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers 9 hours ago

Fix available
Severity - 8.6 (High)

GHSA-34fj-mwm6-fjfg

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf 9 hours ago

Fix available
Severity - 8.6 (High)

GHSA-fgmr-7w36-9qfq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers 9 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-f2rw-w22v-54vh

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers 9 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-mfrj-v65r-979c

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns 9 hours ago

Fix available
Severity - 8.6 (High)

GHSA-5w7r-f4cg-rqq7

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers 9 hours ago

Fix available
Severity - 5.8 (Medium)

GHSA-5fhr-f75j-8wr9

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) yesterday

Fix available
Severity - 5.8 (Medium)

GHSA-8x84-r2ff-h8pq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking yesterday

Fix available
Severity - 7.5 (High)

GHSA-jv8v-xq2h-657v

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath yesterday

Fix available
Severity - 5.3 (Medium)

GHSA-qvq9-hq6p-v378

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents yesterday

Fix available
Severity - 5.8 (Medium)

GHSA-vpjw-wf5h-cgpq

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents yesterday

Fix available
Severity - 8.6 (High)

GHSA-67x2-mq63-v9vm

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents yesterday

Fix available
Severity - 5.8 (Medium)

GHSA-6mcf-g667-w3qv

Go/github.com/siyuan-note/siyuan/kernel

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) yesterday

Fix available
Severity - 5.8 (Medium)

Vulnerabilities