Skip to contentSiyuan-note vulnerabilities
Newest
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationIDCVE-2026-730486.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Missing Authorization via refreshBacklinkCVE-2026-72812Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 SQL Injection via backlink searchCVE-2026-72811Fix available9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketCVE-2026-72810Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Local StorageCVE-2026-736106.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getBookmarkLabelsCVE-2026-73609Fix available6.9 Medium
- siyuan-note siyuanSiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetCVE-2026-73608Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getOutlineStorageCVE-2026-73607Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getRefIDsCVE-2026-73606Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Path Traversal via getUniqueFilenameCVE-2026-73605Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Localhost TrustCVE-2026-72809Fix available7.1 High
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getFileAnnotationCVE-2026-72808Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 SQL Injection via queryBlocks templateCVE-2026-72807Fix available8.8 High
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Attribute ViewCVE-2026-72806Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Block EndpointsCVE-2026-72805Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Graph EndpointsCVE-2026-72804Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getBlockAttrsCVE-2026-72803Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via resolveAssetPathCVE-2026-72802Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Encryption Key MaterialCVE-2026-72801Fix available8.7 High
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Unfiltered APICVE-2026-72800Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Path ResolutionCVE-2026-72799Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via renderAttributeViewCVE-2026-72798Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatusCVE-2026-72797Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Access Control Bypass via Static RoutesCVE-2026-72796Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Embed BlockCVE-2026-72795Fix available9.2 Critical
- siyuan-note siyuansiyuan before v3.7.4 Session Cookie Key Disclosure via getConfCVE-2026-72794Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via /api/system/getConfCVE-2026-72793Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Tag APICVE-2026-72792Fix available6.9 Medium
- siyuan-note siyuanSiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViewsCVE-2026-72791Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getNotebookInfoCVE-2026-72790Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Encrypted NotebooksCVE-2026-72789Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via UILayout FilterCVE-2026-72788Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.3 Path Traversal via unvalidated avIDCVE-2026-69086Fix available8.3 High
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via searchDocsCVE-2026-69085Fix available9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via searchEmbedBlockCVE-2026-69084Public exploitFix available9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentCVE-2026-69083Public exploitFix available9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Information Disclosure via getHeading*TransactionCVE-2026-68587Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Content Disclosure via getBacklinkDocCVE-2026-68586Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Metadata Disclosure via getBlockInfoCVE-2026-68585Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.3 Authentication Bypass via Content EndpointsCVE-2026-68584Fix available9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Stored XSS to RCE via title-img IALCVE-2026-663969.3 Critical
- siyuan-note siyuanSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan ProtocolCVE-2026-663959.4 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer BypassCVE-2026-66394Fix available9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCPCVE-2026-6601210.0 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Path Traversal via /export/temp/CVE-2026-65607Fix available7.1 High
- siyuan-note siyuanSiYuan before v3.7.2 Cross-Site Scripting to RCECVE-2026-656069.4 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Stored XSS to RCE via Attribute ViewCVE-2026-656059.4 Critical
- siyuan-note siyuanSiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspaceCVE-2026-598544.9 Medium
- siyuan-note siyuanSiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)CVE-2026-598536.5 Medium
- siyuan-note siyuanSiYuan: Store XSS To Rce via Asset.renderCVE-2026-598558.6 High
- Show moreLoading…