CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-69084 — SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, whic...

·Source: NIST NVD

Updated:

Executive Summary

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the u

Analysis

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3. CVSS Score: 10. Published: 2026-08-03T14:16:28.680.

Indicators of Compromise (1)

CVE (1)
CVE-2026-69084
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Patelco Credit Union invests in Payfinia CUSO

Payfinia, an independent payment services firm providing an open payments framework, today announced a strategic partnership with Dublin, Calif.-based Patelco Credit Union (‘Patelco’ – $9.5 billion in assets and more than 550,000 members), marked by the credit union’s investment* in the Payfinia Credit Union Service Organization (CUSO).

Finextra
MEDIUMVulnerability

Agent Val Now Validates the Entire Attack Surface: From Network to Host

Powered by TruConfirm — Exploit Validation That Now Runs on the Network and the Host Executive Summary Qualys TruConfirm now validates exploitability across the entire attack surface, not just the network. Cloud Agent-Based TruConfirm brings the same proof-based validation model to the endpoint, closing the gap on local, kernel, browser, and post-authentication CVEs that network [&#8230;]

Qualys Blog
MEDIUMVulnerability

Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion

The payments giant says BioCatch’s behavioral and device intelligence will help financial institutions combat account takeovers, scams and other forms of digital fraud. The post Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion appeared first on SecurityWeek .

SecurityWeek