siyuan vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

SI

Product

siyuan

by siyuan-note · last CVE Oct 28, 2026

215

CVEs

0

On KEV

10.0

Max CVSS

13

New 30D

Vulnerabilities215 In the news0 Timeline

Severity mix

Critical 41High 90Medium 84Low 0

Severity

All severities215 Critical41 High90 Medium84 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add siyuan to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-59809	4.9	0%	Aug 22	SiYuan before v3.8.0 Secret Exfiltration via http_request URL Affected: before 3.8.0
CVE-2026-59854	4.9	0%	Jul 9	SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace Affected: < 3.7.1
CVE-2026-32747	4.9	0%	Mar 19	SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets Affected: < 3.6.1
CVE-2026-100640	4.7	0%	Sep 26	SiYuan before v3.8.4 Clipboard Data Disclosure via IPC Affected: before 3.8.4
CVE-2026-100634	4.7	1%	Sep 26	SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows Affected: before 3.8.4
CVE-2026-118680 New	4.4	–	Oct 28	SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias Affected: 3.8.7 through 3.8.8
CVE-2026-116171 New	4.4	1%	Oct 25	SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix Affected: 3.5.4 before 3.8.7
CVE-2026-82650	4.4	0%	Aug 30	SiYuan before v3.8.1 Path Traversal via /api/template/render Affected: before 3.8.1
CVE-2026-93921	4.3	0%	Sep 18	SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint Affected: through 3.8.4
CVE-2026-86191	4.3	0%	Sep 5	SiYuan before v3.8.2 Private Attribute View Key Enumeration Affected: before 3.8.2
CVE-2026-85579	4.3	0%	Sep 4	SiYuan before v3.8.2 Information Disclosure via undoState Affected: before 3.8.2
CVE-2026-74903	4.3	0%	Aug 18	SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM Affected: before 3.7.4
CVE-2026-45147	4.3	0%	May 14	SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk Affected: < 3.7.0
CVE-2026-45148	4.3	0%	May 14	SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata Affected: < 3.7.0
CVE-2026-74867	4.2	0%	Aug 17	SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth Affected: before 3.7.4