CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-73053 — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in th...

·Source: NIST NVD

Updated:

Executive Summary

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

Analysis

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system. CVSS Score: 9. Published: 2026-08-15T22:16:55.157.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73053
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 15, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight

A two-stage review of 4,019 medical and dental practices found an estimated 21,117 public replies that met a conservative patient-information […] The post We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerabilityNEW

Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates

The bugs could be exploited to crash Safari, corrupt memory, leak sensitive data, escape the sandbox, and exfiltrate data. The post Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15748 — The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload...

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th

CVE-2026-15748
NIST NVD