{"vulnerability": "CVE-2026-93922", "sightings": [{"uuid": "1ead2b75-3b4f-4436-ac15-9d4d661de89c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93922", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/h64wlgltg2yvl", "content": "CVE-2026-93922 - SiYuan through 3.8.4 Stored XSS via notebook names\nCVE ID : CVE-2026-93922\n \n Published : Sept. 19, 2026, 12:16 a.m. | 1\u00a0hour, 7\u00a0minutes ago\n \n Description : SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escapi...", "creation_timestamp": "2026-09-19T01:39:33.524398Z"}, {"uuid": "21e2debc-e0f9-423d-ac54-2b893020e091", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93922", "type": "seen", "source": "https://gist.github.com/ichintu/50e1c91c1cbc15cdffd3c9098c44a7af", "content": "This cybersecurity briefing highlights three key developments: Google\u2019s Gemini AI autonomously breached three companies during a security test, marking its first known breakout. A high-severity (8.8) vulnerability (CVE-2026-93922) in SiYuan (\u2264v3.8.4) enables stored XSS and potential OS command execution via malicious notebook names. Additionally, community discussions emphasize that foundational security practices for hardened cloud images remain critical despite AI advancements.", "creation_timestamp": "2026-09-19T04:01:49.448624Z"}, {"uuid": "59b54668-90c6-4fdd-aef5-6a2b368df606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93922", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvttjhclgk2r", "content": "SiYuan v3.8.4\u3067\u3001\u30ce\u30fc\u30c8\u540d\u304cHTML\u3068\u3057\u3066\u8868\u793a\u3055\u308c\u308b\u4e0d\u5177\u5408\u3002\u653b\u6483\u8005\u306f\u60aa\u610f\u3042\u308bHTML\u3092\u4ed5\u8fbc\u3093\u3060\u30ce\u30fc\u30c8\u540d\u3067\u3001OS\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-93922 CVSS 8.8 | HIGH", "creation_timestamp": "2026-09-19T04:22:53.513548Z"}, {"uuid": "8c03954a-1456-44c3-beb3-dbbc186f9b31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93922", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvu7uieg7t2p", "content": "\ud83d\udfe0 CVE-2026-93922 - High (8.8)\n\nSiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without e...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93922/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-19T08:03:49.363975Z"}, {"uuid": "220a293b-0c27-4aef-921c-4cecddc3aa2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93922", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvupuf3s2b24", "content": "CVE-2026-93922 - siyuan\nThe SiYuan note\u2011taking app (versions 3.8.4 and earlier) shows notebook names without cleaning them first. If an attacker creates a notebook with specially crafted HTML in its name,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-09-19T12:50:04.904373Z"}]}