Skip to contentSiyuan-note vulnerabilities
Newest
- siyuan-note siyuanSiYuan before v3.8.2 Path Traversal via symlink in file APICVE-2026-855837.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Unbounded Session Creation via Basic AuthCVE-2026-855827.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationCVE-2026-855818.7 High
- siyuan-note siyuanSiYuan before v3.8.2 Path Guard Bypass via Case MismatchCVE-2026-855807.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Information Disclosure via undoStateCVE-2026-855795.3 Medium
- siyuan-note siyuanSiYuan through 3.8.1 Authorization Bypass via getFileCVE-2026-855787.1 High
- siyuan-note siyuanSiYuan before v3.8.2 TLS Private Key Disclosure via getFileCVE-2026-85175Fix available8.7 High
- siyuan-note siyuanSiYuan before v3.8.2 API Token Exposure via Log FileCVE-2026-851748.7 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via incomplete asset blocklistCVE-2026-848038.6 High
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via block nameCVE-2026-826549.3 Critical
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via confirmDialogCVE-2026-826539.3 Critical
- siyuan-note siyuanSiYuan before v3.8.1 Information Disclosure via Publish AccessCVE-2026-826526.9 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Missing Authorization via /history and /repo/diffCVE-2026-82651Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Path Traversal via /api/template/renderCVE-2026-826505.9 Medium
- siyuan-note siyuanSiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search PathCVE-2026-826497.0 High
- siyuan-note siyuanSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUCVE-2026-82234Fix available8.4 High
- siyuan-note siyuanSiYuan before v3.8.1 Path Traversal via asset.uploadCVE-2026-82233Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Plugin Overwrite via Bazaar InstallCVE-2026-62204Fix available5.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Arbitrary File Deletion via removeTemplateCVE-2026-600848.4 High
- siyuan-note siyuanSiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolCVE-2026-60083Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.0 Secret Exfiltration via http_request URLCVE-2026-598096.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Path Traversal via packageNameCVE-2026-770869.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via pathName.tsCVE-2026-759179.3 Critical
- siyuan-note siyuanSiYuan XSS-to-RCE via unescaped block metadata in hint popupCVE-2026-759169.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Incorrect Authorization via Publish AccessCVE-2026-749068.7 High
- siyuan-note siyuanSiYuan before v3.7.4 SSRF via IPv6 Transition Address BypassCVE-2026-749056.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Missing Authorization via block APICVE-2026-74904Fix available8.7 High
- siyuan-note siyuanSiYuan before v3.7.4 Insufficient Access Control via spinBlockDOMCVE-2026-749035.3 Medium
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via malicious filename uploadCVE-2026-749029.3 Critical
- siyuan-note siyuanSiYuan before 3.7.4 Brute-Force Authentication via Publish ServiceCVE-2026-748688.7 High
- siyuan-note siyuanSiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuthCVE-2026-748672.3 Low
- siyuan-note siyuanSiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxyCVE-2026-74802Fix available7.1 High
- siyuan-note siyuanSiYuan before 3.7.4 Local Privilege Escalation via elevator.exeCVE-2026-748018.6 High
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via assets endpointCVE-2026-748009.4 Critical
- siyuan-note siyuanSiYuan before 3.7.4 Unauthenticated Debug Endpoint Information DisclosureCVE-2026-747999.2 Critical
- siyuan-note siyuanSiYuan kernel Path Traversal via database_clean MCP toolCVE-2026-747989.3 Critical
- siyuan-note siyuanSiYuan kernel before 3.7.4 Unthrottled Brute-Force via API TokenCVE-2026-730569.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via WebSocketCVE-2026-73054Fix available8.7 High
- siyuan-note siyuanSiYuan before v3.7.4 Cross-Site Scripting via unicode2EmojiCVE-2026-730539.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via Attribute-View Field NamesCVE-2026-730529.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via select option colorCVE-2026-730509.4 Critical
- siyuan-note siyuansiyuan before v3.7.4 Server-Side Template Injection via attribute-viewCVE-2026-730478.6 High
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via HTTP Basic AuthCVE-2026-730469.3 Critical
- siyuan-note siyuanSiYuan before 3.7.4 Brute-Force via authFilePublishAccessCVE-2026-730458.7 High
- siyuan-note siyuanSiYuan before v3.7.4 Stored Cross-Site Scripting via Column WidthCVE-2026-730449.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via Template CalculationCVE-2026-730439.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via Menu MetadataCVE-2026-730429.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via PDF AnnotationsCVE-2026-730419.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via authFilePublishAccessCVE-2026-73630Fix available6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinksCVE-2026-73049Fix available6.9 Medium
- Show moreLoading…