aug 30, 2026
9 links from the engineering internet.
siyuan 3.8.1 patches a critical stored xss in confirmdialog
cve-2026-82653, cvss 9.3: package and notebook names go straight into innerhtml assignments, so a malicious bazaar package fires script when someone uninstalls it or unlocks an encrypted notebook. fixed in v3.8.1.
siyuan windows installer invokes taskkill by name and gets hijacked
cve-2026-82649: the nsis installer calls system executables by name and the launch directory sits ahead of system32 on the search path. a binary dropped next to the installer runs with an elevated token during an all-users install. fixed in 3.8.1.
nextchat leaks its openai key to any url containing api.openai.com
cve-2026-82639, cvss 8.7: the proxy endpoint validates the x-base-url header by substring match instead of hostname parsing, so a crafted url passes and the server forwards its api key in the authorization header. affects 2.15.8 through 2.16.1.
keploy exposes tls session keys on an unauthenticated control plane
cve-2026-82641, cvss 8.8: versions 3.1.0 to 3.6.25 bind the agent control-plane http server to all interfaces with no auth. /agent/pcap/keylog streams nss keylog lines, which is enough to decrypt the recorded tls traffic.
frappe print permission is enough to run arbitrary jinja and selects
cve-2026-82634: the render_jinja_template endpoint accepts raw template strings from any low-privileged user holding print permission on any document, which turns into select queries against unrelated tables, password hashes in __auth included.
admidio blind sqli in lists_show.php needs no authentication
cve-2026-82655, cvss 8.7: the relation_type_list parameter reaches sql unsanitized, and a dummy uuid in the role_list field gets you there without logging in. enough to pull password hashes out. patched in 5.0.12.
avideo hands out live stream keys to anyone who forges a token
cve-2026-82645, cvss 9.2: getlivekey.json.php takes an unauthenticated token and returns youtube, facebook and twitch stream keys. tokens carry no user binding or expiry, and aes-256-cbc with a deterministic iv plus a public encryption oracle makes them forgeable.
readest 0.11.16 blocks iframe srcdoc after an epub xss bypass
cve-2026-82642, cvss 8.8: the chapter sanitizer forbade only the script tag, and dompurify never parses srcdoc, so an invisible iframe carried executable html straight through. 0.11.16 adds iframe, object and embed to the deny list.
dolibarr rest api returns any user's group memberships
cve-2026-82633: get /users/{id}/groups skipped per-object authorization, so any authenticated caller could read group names, entity associations and private notes across tenant boundaries. fixed in 24.0.0.