SI
Vendor
siyuan-note
214
CVEs
0
On KEV
14
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116171 New | SI siyuan siyuan-note | 7.5 | Oct 25 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix |
| CVE-2026-116170 New | SI siyuan siyuan-note | 4.9 | Oct 25 | SiYuan before v3.8.7 SQL Injection via History Search op and query |
| CVE-2026-116169 New | SI siyuan siyuan-note | 5.4 | Oct 25 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks |
| CVE-2026-116168 New | SI siyuan siyuan-note | 6.2 | Oct 25 | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool |
| CVE-2026-116167 New | SI siyuan siyuan-note | 6.8 | Oct 25 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter |
| CVE-2026-116166 New | SI siyuan siyuan-note | 6.8 | Oct 25 | SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting |
| CVE-2026-109310 | SI siyuan siyuan-note | 6.5 | Oct 12 | SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template |
| CVE-2026-109309 | SI siyuan siyuan-note | 6.5 | Oct 12 | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path |
| CVE-2026-105205 | SI siyuan siyuan-note | 5.3 | Oct 4 | SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo |
| CVE-2026-104410 | SI siyuan siyuan-note | 7.5 | Oct 2 | SiYuan before 3.8.5 Information Disclosure via /api/export/preview |
| CVE-2026-103763 | SI siyuan siyuan-note | 5.8 | Oct 2 | SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo |
| CVE-2026-103762 | SI siyuan siyuan-note | 5.3 | Oct 2 | SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints |
| CVE-2026-101092 | SI siyuan siyuan-note | 5.3 | Sep 28 | SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages |
| CVE-2026-101091 | SI siyuan siyuan-note | 7.1 | Sep 28 | SiYuan before v3.8.4 SQL Injection via Block Query Embed |
| CVE-2026-100646 | SI siyuan siyuan-note | 8.1 | Sep 26 | SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header |
| CVE-2026-100645 | SI siyuan siyuan-note | 8.0 | Sep 26 | SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban |
| CVE-2026-100644 | SI siyuan siyuan-note | 7.5 | Sep 26 | SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath |
| CVE-2026-100643 | SI siyuan siyuan-note | 8.0 | Sep 26 | SiYuan before v3.8.4 Stored XSS via Attribute View textarea |
| CVE-2026-100642 | SI siyuan siyuan-note | 7.6 | Sep 26 | SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth |
| CVE-2026-100641 | SI siyuan siyuan-note | 8.0 | Sep 26 | SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content |
| CVE-2026-100640 | SI siyuan siyuan-note | 4.7 | Sep 26 | SiYuan before v3.8.4 Clipboard Data Disclosure via IPC |
| CVE-2026-100639 | SI siyuan siyuan-note | 8.8 | Sep 26 | SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL |
| CVE-2026-100638 | SI siyuan siyuan-note | 7.6 | Sep 26 | SiYuan before v3.8.4 Path Traversal via setNotebookIcon |
| CVE-2026-100637 | SI siyuan siyuan-note | 7.6 | Sep 26 | SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID |
| CVE-2026-100636 | SI siyuan siyuan-note | 7.6 | Sep 26 | SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder |
| CVE-2026-100635 | SI siyuan siyuan-note | 5.9 | Sep 26 | SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie |
| CVE-2026-100634 | SI siyuan siyuan-note | 4.7 | Sep 26 | SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows |
| CVE-2026-100633 | SI siyuan siyuan-note | 6.5 | Sep 26 | SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations |
| CVE-2026-93923 | SI siyuan siyuan-note | 8.8 | Sep 18 | SiYuan through 3.8.4 Stored XSS via Heading Style Attribute |
| CVE-2026-93922 | SI siyuan siyuan-note | 8.8 | Sep 18 | SiYuan through 3.8.4 Stored XSS via notebook names |
| CVE-2026-93921 | SI siyuan siyuan-note | 4.3 | Sep 18 | SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint |
| CVE-2026-93591 | SI siyuan siyuan-note | 7.6 | Sep 18 | SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go |
| CVE-2026-92986 | SI siyuan siyuan-note | 8.8 | Sep 17 | SiYuan before 3.8.4 Cross-Site Scripting via Document Title |
| CVE-2026-92985 | SI siyuan siyuan-note | 8.8 | Sep 17 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels |
| CVE-2026-87815 | SI siyuan siyuan-note | 8.7 | Sep 9 | SiYuan before v3.8.2 Path Traversal via removeRiffDeck |
| CVE-2026-87814 | SI siyuan siyuan-note | 7.3 | Sep 9 | SiYuan before v3.8.2 Stored XSS via Asset Preview |
| CVE-2026-87813 | SI siyuan siyuan-note | 7.3 | Sep 9 | SiYuan before v3.8.2 Stored XSS via unescaped asset filenames |
| CVE-2026-87812 | SI siyuan siyuan-note | 6.8 | Sep 9 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL |
| CVE-2026-87811 | SI siyuan siyuan-note | 7.3 | Sep 9 | SiYuan before v3.8.2 Stored XSS via notebook template paths |
| CVE-2026-87810 | SI siyuan siyuan-note | 5.3 | Sep 9 | Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock |
| CVE-2026-87809 | SI siyuan siyuan-note | 6.5 | Sep 9 | Siyuan before v3.8.2 Information Disclosure via Export Preview |
| CVE-2026-87808 | SI siyuan siyuan-note | 4.9 | Sep 9 | SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock |
| CVE-2026-87807 | SI siyuan siyuan-note | 7.5 | Sep 9 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock |
| CVE-2026-86712 | SI siyuan siyuan-note | 8.8 | Sep 8 | SiYuan before 3.8.2 Remote Code Execution via Clipboard |
| CVE-2026-86192 | SI siyuan siyuan-note | 6.5 | Sep 5 | SiYuan before v3.8.2 Information Disclosure via Attribute-View |
| CVE-2026-86191 | SI siyuan siyuan-note | 4.3 | Sep 5 | SiYuan before v3.8.2 Private Attribute View Key Enumeration |
| CVE-2026-85585 | SI siyuan siyuan-note | 7.5 | Sep 4 | SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency |
| CVE-2026-85584 | SI siyuan siyuan-note | 7.5 | Sep 4 | SiYuan before v3.8.2 Denial of Service via Auth Throttle |
| CVE-2026-85583 | SI siyuan siyuan-note | 6.5 | Sep 4 | SiYuan before v3.8.2 Path Traversal via symlink in file API |
| CVE-2026-85582 | SI siyuan siyuan-note | 6.5 | Sep 4 | SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth |
| CVE-2026-85581 | SI siyuan siyuan-note | 7.5 | Sep 4 | SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration |
| CVE-2026-85580 | SI siyuan siyuan-note | 6.5 | Sep 4 | SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch |
| CVE-2026-85579 | SI siyuan siyuan-note | 4.3 | Sep 4 | SiYuan before v3.8.2 Information Disclosure via undoState |
| CVE-2026-85578 | SI siyuan siyuan-note | 6.5 | Sep 4 | SiYuan through 3.8.1 Authorization Bypass via getFile |
| CVE-2026-85175 | SI siyuan siyuan-note | 8.8 | Sep 3 | SiYuan before v3.8.2 TLS Private Key Disclosure via getFile |
| CVE-2026-85174 | SI siyuan siyuan-note | 8.8 | Sep 3 | SiYuan before v3.8.2 API Token Exposure via Log File |
| CVE-2026-84803 | SI siyuan siyuan-note | 9.0 | Sep 2 | SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist |
| CVE-2026-82654 | SI siyuan siyuan-note | 8.9 | Aug 30 | SiYuan before v3.8.1 Stored XSS via block name |
| CVE-2026-82653 | SI siyuan siyuan-note | 8.9 | Aug 30 | SiYuan before v3.8.1 Stored XSS via confirmDialog |
| CVE-2026-82652 | SI siyuan siyuan-note | 5.3 | Aug 30 | SiYuan before v3.8.1 Information Disclosure via Publish Access |