CVE-2026-74799
Critical · 9.3CVSS
9.3
EPSS
—
Published
Aug 17, 2026
CISA due date
—
The record
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79694 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-215
- CVE-2026-62652 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-215
- CVE-2026-44934 A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before… CWE-215
- CVE-2026-33247 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging… CWE-215
- CVE-2026-2250 The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. CWE-215