https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T01:48:13.360928+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-74799 fkie_cve-2026-74799 2026-10-06T01:48:13.363748+00:00

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

 https://vulnerability.circl.lu/vuln/ghsa-hmr2-j8m8-f585 GHSA-hmr2-j8m8-f585 2026-10-06T01:48:13.363887+00:00

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.