https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:04:47.461537+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-354969 EUVD-2026-354969 2026-10-07T03:04:47.506452+00:00 EUVD-2026-354969 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74867 fkie_cve-2026-74867 2026-10-07T03:04:47.506488+00:00

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.

 https://cve.radiocsirt.org/vuln/ghsa-ph2h-92xh-5vmg GHSA-ph2h-92xh-5vmg 2026-10-07T03:04:47.506521+00:00

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.