SI
Product
siyuan
219
CVEs
0
On KEV
10.0
Max CVSS
13
New 30D
Severity mix
Critical 42High 92Medium 85Low 0
Watch
Add siyuan to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72792 | 5.8 | Aug 12 | SiYuan before v3.7.4 Information Disclosure via Tag API Affected: before 3.7.4 |
| CVE-2026-72791 | 5.8 | Aug 12 | SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews Affected: before 3.7.4 |
| CVE-2026-72790 | 5.8 | Aug 12 | SiYuan before v3.7.4 Information Disclosure via getNotebookInfo Affected: before 3.7.4 |
| CVE-2026-72788 | 5.8 | Aug 12 | SiYuan before v3.7.4 Information Disclosure via UILayout Filter Affected: before 3.7.4 |
| CVE-2026-68585 | 5.8 | Aug 3 | SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo Affected: before 3.7.3 |
| CVE-2026-82233 | 5.7 | Aug 28 | SiYuan before v3.8.1 Path Traversal via asset.upload Affected: before 3.8.1 |
| CVE-2026-116169 New | 5.4 | Oct 25 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks Affected: 2.10.0 before 3.8.7 |
| CVE-2026-40922 | 5.4 | Apr 16 | SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066) Affected: < 3.6.4 |
| CVE-2026-25647 | 5.4 | Feb 6 | Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink Affected: < 3.5.5 |
| CVE-2024-55659 | 5.4 | Dec 11 | SiYuan has an arbitrary file write in the host via /api/asset/upload Affected: < 3.1.16 |
| CVE-2026-105205 | 5.3 | Oct 4 | SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo Affected: before 3.8.5 |
| CVE-2026-103762 | 5.3 | Oct 2 | SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints Affected: before 3.8.5 |
| CVE-2026-101092 | 5.3 | Sep 28 | SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages Affected: before 3.8.4 |
| CVE-2026-87810 | 5.3 | Sep 9 | Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock Affected: before 3.8.2 |
| CVE-2026-82652 | 5.3 | Aug 30 | SiYuan before v3.8.1 Information Disclosure via Publish Access Affected: before 3.8.1 |
| CVE-2026-72802 | 5.3 | Aug 12 | SiYuan before v3.7.4 Information Disclosure via resolveAssetPath Affected: before 3.7.4 |
| CVE-2026-116170 New | 4.9 | Oct 25 | SiYuan before v3.8.7 SQL Injection via History Search op and query Affected: before 3.8.7 |
| CVE-2026-87808 | 4.9 | Sep 9 | SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock Affected: before 3.8.2 |
| CVE-2026-82651 | 4.9 | Aug 30 | SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff Affected: before 3.8.1 |
| CVE-2026-60083 | 4.9 | Aug 22 | SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool Affected: before 3.8.0 |
| CVE-2026-59809 | 4.9 | Aug 22 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL Affected: before 3.8.0 |
| CVE-2026-59854 | 4.9 | Jul 9 | SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace Affected: < 3.7.1 |
| CVE-2026-32747 | 4.9 | Mar 19 | SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets Affected: < 3.6.1 |
| CVE-2026-100640 | 4.7 | Sep 26 | SiYuan before v3.8.4 Clipboard Data Disclosure via IPC Affected: before 3.8.4 |
| CVE-2026-100634 | 4.7 | Sep 26 | SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows Affected: before 3.8.4 |
| CVE-2026-118680 New | 4.4 | Oct 28 | SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias Affected: 3.8.7 through 3.8.8 |
| CVE-2026-116171 New | 4.4 | Oct 25 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix Affected: 3.5.4 before 3.8.7 |
| CVE-2026-82650 | 4.4 | Aug 30 | SiYuan before v3.8.1 Path Traversal via /api/template/render Affected: before 3.8.1 |
| CVE-2026-93921 | 4.3 | Sep 18 | SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint Affected: through 3.8.4 |
| CVE-2026-86191 | 4.3 | Sep 5 | SiYuan before v3.8.2 Private Attribute View Key Enumeration Affected: before 3.8.2 |
| CVE-2026-85579 | 4.3 | Sep 4 | SiYuan before v3.8.2 Information Disclosure via undoState Affected: before 3.8.2 |
| CVE-2026-74903 | 4.3 | Aug 18 | SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM Affected: before 3.7.4 |
| CVE-2026-45147 | 4.3 | May 14 | SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk Affected: < 3.7.0 |
| CVE-2026-45148 | 4.3 | May 14 | SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata Affected: < 3.7.0 |
| CVE-2026-74867 | 4.2 | Aug 17 | SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth Affected: before 3.7.4 |