This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-74799 | BDVDB-2026-360650 Detail

siyuan-notesiyuan

Description#

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact low. Attack vector: network.

Weaknesses#

  • CWE-215 Insertion of Sensitive Information Into Debugging Code

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.