https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:52:57.675509+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-362016 EUVD-2026-362016 2026-10-08T14:52:57.732542+00:00 EUVD-2026-362016 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82233 fkie_cve-2026-82233 2026-10-08T14:52:57.732604+00:00

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

 https://cve.radiocsirt.org/vuln/ghsa-m4pm-qxhv-84p5 GHSA-m4pm-qxhv-84p5 2026-10-08T14:52:57.732643+00:00

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.