CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-73050 — SiYuan versions before v3.7.4 fail to validate or escape the color field in attr...

·Source: NIST NVD

Updated:

Executive Summary

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

Analysis

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field. CVSS Score: 9. Published: 2026-08-15T22:16:54.870.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73050
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 15, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight

A two-stage review of 4,019 medical and dental practices found an estimated 21,117 public replies that met a conservative patient-information […] The post We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerabilityNEW

Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates

The bugs could be exploited to crash Safari, corrupt memory, leak sensitive data, escape the sandbox, and exfiltrate data. The post Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15748 — The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload...

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th

CVE-2026-15748
NIST NVD