Signal is active with 2 mentions in latest observed window
Immediate actions
Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.
CVE-2026-82880 YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity… https://www.cve.org/CVERecord?id=CVE-2026-82880
Post summary
CVE-2026-82880 is an XML External Entity injection vulnerability in YaCy Search Server's SVG, FreeMind, and OpenSearch parsers; the notice contains no PoC, exploit, patch detail, or active exploitation claim.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day.
𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 31 Aug 2026
𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Stored cross-site scripting in a self-hosted notes app — script runs in the workspace owner's session, with the whole kernel API behind it (SiYuan CVE-2026-82653, SiYuan CVE-2026-82654)
📦 XML external entity injection in a search engine's document parsers — a page the crawler was pointed at reads files off the machine running it (YaCy CVE-2026-82880)
🔎 Technology fingerprint for a self-hosted BI platform — the product is identifiable now, so advisories against it can be matched at all (DataEase)
Test your stack with NewScan — free, self-hosted:
https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve
#infosec#AppSec#XSS#CSO#REDTEAM
Post summary
The tweet announces three newly disclosed CVEs, detailing a stored XSS in SiYuan, an XEE in YaCy, and a fingerprinting vulnerability in DataEase, without mentioning exploits, patches, or active attacks.
