Siyuan-note vulnerabilities

Products

• Siyuan 223

Newest

• siyuan-note siyuan SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read CVE-2026-123492 6.9 MediumNovember 6, 2026
• siyuan-note siyuan SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias CVE-2026-118680 5.9 MediumOctober 28, 2026
• siyuan-note siyuan SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix CVE-2026-116171 5.9 MediumOctober 25, 2026
• siyuan-note siyuan SiYuan before v3.8.7 SQL Injection via History Search op and query CVE-2026-116170 6.9 MediumOctober 25, 2026
• siyuan-note siyuan SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks CVE-2026-116169 5.1 MediumOctober 25, 2026
• siyuan-note siyuan SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool CVE-2026-116168 6.9 MediumOctober 25, 2026
• siyuan-note siyuan SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter CVE-2026-116167 7.6 HighOctober 25, 2026
• siyuan-note siyuan SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting CVE-2026-116166 7.6 HighOctober 25, 2026
• siyuan-note siyuan SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template CVE-2026-109310 7.1 HighOctober 12, 2026
• siyuan-note siyuan SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path CVE-2026-109309 6.9 MediumOctober 12, 2026
• siyuan-note siyuan SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo CVE-2026-105205 6.9 MediumOctober 4, 2026
• siyuan-note siyuan SiYuan before 3.8.5 Information Disclosure via /api/export/preview CVE-2026-104410 8.7 HighOctober 2, 2026
• siyuan-note siyuan SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo CVE-2026-103763 6.9 MediumOctober 2, 2026
• siyuan-note siyuan SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints CVE-2026-103762 6.9 MediumOctober 2, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages CVE-2026-101092 6.9 MediumSeptember 28, 2026
• siyuan-note siyuan SiYuan before v3.8.4 SQL Injection via Block Query Embed CVE-2026-101091 7.1 HighSeptember 28, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header CVE-2026-100646 8.6 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban CVE-2026-100645 8.6 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath CVE-2026-100644 8.7 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Stored XSS via Attribute View textarea CVE-2026-100643 8.5 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth CVE-2026-100642 7.2 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content CVE-2026-100641 8.6 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Clipboard Data Disclosure via IPC CVE-2026-100640 8.6 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL CVE-2026-100639 8.6 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Path Traversal via setNotebookIcon CVE-2026-100638 8.3 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID CVE-2026-100637 8.3 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder CVE-2026-100636 8.3 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie CVE-2026-100635 8.2 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows CVE-2026-100634 5.3 MediumSeptember 26, 2026
• siyuan-note siyuan SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations CVE-2026-100633 Public exploit 8.5 HighSeptember 26, 2026
• siyuan-note siyuan SiYuan through 3.8.4 Stored XSS via Heading Style Attribute CVE-2026-93923 8.6 HighSeptember 18, 2026
• siyuan-note siyuan SiYuan through 3.8.4 Stored XSS via notebook names CVE-2026-93922 8.6 HighSeptember 18, 2026
• siyuan-note siyuan SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint CVE-2026-93921 5.3 MediumSeptember 18, 2026
• siyuan-note siyuan SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go CVE-2026-93591 7.2 HighSeptember 18, 2026
• siyuan-note siyuan SiYuan before 3.8.4 Cross-Site Scripting via Document Title CVE-2026-92986 8.6 HighSeptember 17, 2026
• siyuan-note siyuan SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels CVE-2026-92985 8.6 HighSeptember 17, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Path Traversal via removeRiffDeck CVE-2026-87815 8.4 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Stored XSS via Asset Preview CVE-2026-87814 8.4 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Stored XSS via unescaped asset filenames CVE-2026-87813 8.4 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Stored XSS via Bazaar iconURL CVE-2026-87812 7.4 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Stored XSS via notebook template paths CVE-2026-87811 8.4 HighSeptember 9, 2026
• siyuan-note siyuan Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock CVE-2026-87810 6.9 MediumSeptember 9, 2026
• siyuan-note siyuan Siyuan before v3.8.2 Information Disclosure via Export Preview CVE-2026-87809 7.1 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock CVE-2026-87808 8.7 HighSeptember 9, 2026
• siyuan-note siyuan siyuan before v3.8.2 SQL Injection via fullTextSearchBlock CVE-2026-87807 8.7 HighSeptember 9, 2026
• siyuan-note siyuan SiYuan before 3.8.2 Remote Code Execution via Clipboard CVE-2026-86712 8.6 HighSeptember 8, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Information Disclosure via Attribute-View CVE-2026-86192 7.1 HighSeptember 5, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Private Attribute View Key Enumeration CVE-2026-86191 5.3 MediumSeptember 5, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency CVE-2026-85585 8.7 HighSeptember 4, 2026
• siyuan-note siyuan SiYuan before v3.8.2 Denial of Service via Auth Throttle CVE-2026-85584 8.7 HighSeptember 4, 2026
• Show olderLoading…