Threat Advisories - NVD Disclosed June 21, 2026

CVE-2026-56397

SiYuan Bazaar Marketplace XSS Leads to Remote Code Execution.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A vulnerability in SiYuan's Bazaar marketplace allows attackers to inject malicious HTML and JavaScript into package details. This can lead to remote code execution on user systems when the marketplace is browsed, potentially enabling attackers to run OS commands. The risk is to users who interact with the application'

NVD published: June 21, 2026

CVE advisoryCRITICAL

CVE-2026-56395

SiYuan Bazaar Package Metadata Vulnerability Allows Remote Code Execution.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

SiYuan's Bazaar marketplace has a flaw that allows malicious actors to inject arbitrary HTML and JavaScript through package metadata and README files. This could lead to remote code execution on user systems when they browse compromised packages in the marketplace.

NVD published: June 21, 2026

CVE advisoryCRITICAL

CVE-2026-56265

Crawl4AI Authentication Bypass Via Hardcoded JWT Signing Key

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A hardcoded JWT signing key in Crawl4AI's Docker API server enables authentication bypass. Attackers can forge tokens to gain unauthorized full access to protected functionality.

NVD published: June 21, 2026