[vulnfeed] 4 critical CVEs — 2026-10-01 12:00 UTC
vulnfeed
Critical alert — 2026-10-01 15:35 UTC
4 new critical CVEs
in the last 5 hours — 4 CVSS ≥ 9.0
New vulnerabilities
GHSA-33jq-p8c2-q3q4CRITICAL
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/
### Summary
The `/api/filetree/searchDocs` endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by `
CVSS 10.0
CVE-2026-79901CRITICAL
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory serv
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Un
CVSS 9.9
CVE-2026-103244CRITICAL
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore comma
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup m
CVSS 9.3
CVE-2026-103264CRITICAL
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hos
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthen
CVSS 9.3
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: