What you need to know today.
Critical RCE and auth bypass flaws hit SiYuan Note, while WordPress plugins and Scriban face multiple high-severity vulnerabilities.
A critical remote code execution vulnerability in SiYuan Note versions prior to v3.7.4 allows attackers to inject malicious HTML and execute arbitrary code by exploiting the Template calculation operator. This operator renders user-authored Go templates and stores output verbatim without sanitization, posing a significant risk. Additionally, multiple cross-site scripting (XSS) vulnerabilities exist in various components, including the unicode2Emoji function, attribute-view field names, and table column width values, enabling attackers to inject malicious payloads that execute as script in the renderer. The vulnerability was disclosed by Vypr Intelligence, which also detailed improper restriction of excessive authentication attempts in the CheckAuth() middleware, allowing API token bypass. CVEs include CVE-2026-73043, CVE-2026-73053, CVE-2026-73052, CVE-2026-73050, CVE-2026-73044, CVE-2026-73042, CVE-2026-73041, and CVE-2026-73046.
WordPress plugins continue to be a target, with several critical vulnerabilities disclosed. The ARForms plugin (up to 1.8.5) is susceptible to PHP Object Injection via deserialization of untrusted input from form submissions (CVE-2024-13784). The Frontend Admin by DynamiApps plugin (up to 3.29.9) suffers from a privilege escalation flaw due to insufficient capability checks in ActionUser::conditions_logic() (CVE-2026-18432). Furthermore, the ProSolution WP Client plugin is affected by arbitrary file uploads in versions up to 2.0.10 due to missing validation in proSol_handleFileUpload (CVE-2026-16098), and arbitrary file deletion in versions up to 2.0.8 via the proSol_fileDeleteProcess function (CVE-2026-14524). The Pods – Custom Content Types and Fields plugin (up to 3.3.9) also has a privilege escalation vulnerability due to an authorization bypass in the pods_admin AJAX router (CVE-2026-19598).
Scriban, a .NET templating engine, has disclosed two critical vulnerabilities. An access-modifier bypass in TypedObjectAccessor (CVE-2026-73061) allows template code to write to CLR object properties without setter-visibility checks, potentially leading to unauthorized modifications. A separate vulnerability (CVE-2026-74790) arises from Scriban's caching mechanism for TypedObjectAccessor, which, without considering MemberFilter changes, can expose previously hidden members when template contexts are reused. Additionally, a denial-of-service vulnerability in the array.insert_at function (CVE-2026-74784) allows attackers to cause unbounded memory allocation by supplying a large index parameter.
Other notable vulnerabilities include an unauthenticated SQL injection in the Phoca Cart Joomla extension (versions 5.0.0-6.1.6) via the a[] and s[] GET parameters on the shop items page (CVE-2026-74251). Tenda's AC10 router (firmware 16.03.10.09_multi_TDE01) has an improper authentication vulnerability in the R7WebsSecurityHandler function of the httpd component (CVE-2026-19924). Lastly, Pandora analysis software contains a path traversal vulnerability in its TAR archive extraction functionality, allowing archive member names to be processed without proper sanitization (CVE-2026-74764).