# cve.now: Siyuan-note

The newest entries naming Siyuan-note as an affected vendor (up to 200), of 220 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123492](https://cve.now/CVE-2026-123492.md): SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read (CVSS 6.9)
- [CVE-2026-118680](https://cve.now/CVE-2026-118680.md): SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias (CVSS 5.9)
- [CVE-2026-116171](https://cve.now/CVE-2026-116171.md): SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix (CVSS 5.9)
- [CVE-2026-116170](https://cve.now/CVE-2026-116170.md): SiYuan before v3.8.7 SQL Injection via History Search op and query (CVSS 6.9)
- [CVE-2026-116169](https://cve.now/CVE-2026-116169.md): SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \\href in Math Blocks (CVSS 5.1)
- [CVE-2026-116168](https://cve.now/CVE-2026-116168.md): SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool (CVSS 6.9)
- [CVE-2026-116167](https://cve.now/CVE-2026-116167.md): SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter (CVSS 7.6)
- [CVE-2026-116166](https://cve.now/CVE-2026-116166.md): SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting (CVSS 7.6)
- [CVE-2026-109310](https://cve.now/CVE-2026-109310.md): SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template (CVSS 7.1)
- [CVE-2026-109309](https://cve.now/CVE-2026-109309.md): SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path (CVSS 6.9)
- [CVE-2026-105205](https://cve.now/CVE-2026-105205.md): SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo (CVSS 6.9)
- [CVE-2026-104410](https://cve.now/CVE-2026-104410.md): SiYuan before 3.8.5 Information Disclosure via /api/export/preview (CVSS 8.7)
- [CVE-2026-103763](https://cve.now/CVE-2026-103763.md): SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo (CVSS 6.9)
- [CVE-2026-103762](https://cve.now/CVE-2026-103762.md): SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints (CVSS 6.9)
- [CVE-2026-101092](https://cve.now/CVE-2026-101092.md): SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages (CVSS 6.9)
- [CVE-2026-101091](https://cve.now/CVE-2026-101091.md): SiYuan before v3.8.4 SQL Injection via Block Query Embed (CVSS 7.1)
- [CVE-2026-100646](https://cve.now/CVE-2026-100646.md): SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header (CVSS 8.6)
- [CVE-2026-100645](https://cve.now/CVE-2026-100645.md): SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban (CVSS 8.6)
- [CVE-2026-100644](https://cve.now/CVE-2026-100644.md): SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath (CVSS 8.7)
- [CVE-2026-100643](https://cve.now/CVE-2026-100643.md): SiYuan before v3.8.4 Stored XSS via Attribute View textarea (CVSS 8.5)
- [CVE-2026-100642](https://cve.now/CVE-2026-100642.md): SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth (CVSS 7.2)
- [CVE-2026-100641](https://cve.now/CVE-2026-100641.md): SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content (CVSS 8.6)
- [CVE-2026-100640](https://cve.now/CVE-2026-100640.md): SiYuan before v3.8.4 Clipboard Data Disclosure via IPC (CVSS 8.6)
- [CVE-2026-100639](https://cve.now/CVE-2026-100639.md): SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL (CVSS 8.6)
- [CVE-2026-100638](https://cve.now/CVE-2026-100638.md): SiYuan before v3.8.4 Path Traversal via setNotebookIcon (CVSS 8.3)
- [CVE-2026-100637](https://cve.now/CVE-2026-100637.md): SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID (CVSS 8.3)
- [CVE-2026-100636](https://cve.now/CVE-2026-100636.md): SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder (CVSS 8.3)
- [CVE-2026-100635](https://cve.now/CVE-2026-100635.md): SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie (CVSS 8.2)
- [CVE-2026-100634](https://cve.now/CVE-2026-100634.md): SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows (CVSS 5.3)
- [CVE-2026-100633](https://cve.now/CVE-2026-100633.md): SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations (CVSS 8.5)
- [CVE-2026-93923](https://cve.now/CVE-2026-93923.md): SiYuan through 3.8.4 Stored XSS via Heading Style Attribute (CVSS 8.6)
- [CVE-2026-93922](https://cve.now/CVE-2026-93922.md): SiYuan through 3.8.4 Stored XSS via notebook names (CVSS 8.6)
- [CVE-2026-93921](https://cve.now/CVE-2026-93921.md): SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint (CVSS 5.3)
- [CVE-2026-93591](https://cve.now/CVE-2026-93591.md): SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go (CVSS 7.2)
- [CVE-2026-92986](https://cve.now/CVE-2026-92986.md): SiYuan before 3.8.4 Cross-Site Scripting via Document Title (CVSS 8.6)
- [CVE-2026-92985](https://cve.now/CVE-2026-92985.md): SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels (CVSS 8.6)
- [CVE-2026-87815](https://cve.now/CVE-2026-87815.md): SiYuan before v3.8.2 Path Traversal via removeRiffDeck (CVSS 8.4)
- [CVE-2026-87814](https://cve.now/CVE-2026-87814.md): SiYuan before v3.8.2 Stored XSS via Asset Preview (CVSS 8.4)
- [CVE-2026-87813](https://cve.now/CVE-2026-87813.md): SiYuan before v3.8.2 Stored XSS via unescaped asset filenames (CVSS 8.4)
- [CVE-2026-87812](https://cve.now/CVE-2026-87812.md): SiYuan before v3.8.2 Stored XSS via Bazaar iconURL (CVSS 7.4)
- [CVE-2026-87811](https://cve.now/CVE-2026-87811.md): SiYuan before v3.8.2 Stored XSS via notebook template paths (CVSS 8.4)
- [CVE-2026-87810](https://cve.now/CVE-2026-87810.md): Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock (CVSS 6.9)
- [CVE-2026-87809](https://cve.now/CVE-2026-87809.md): Siyuan before v3.8.2 Information Disclosure via Export Preview (CVSS 7.1)
- [CVE-2026-87808](https://cve.now/CVE-2026-87808.md): SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock (CVSS 8.7)
- [CVE-2026-87807](https://cve.now/CVE-2026-87807.md): siyuan before v3.8.2 SQL Injection via fullTextSearchBlock (CVSS 8.7)
- [CVE-2026-86712](https://cve.now/CVE-2026-86712.md): SiYuan before 3.8.2 Remote Code Execution via Clipboard (CVSS 8.6)
- [CVE-2026-86192](https://cve.now/CVE-2026-86192.md): SiYuan before v3.8.2 Information Disclosure via Attribute-View (CVSS 7.1)
- [CVE-2026-86191](https://cve.now/CVE-2026-86191.md): SiYuan before v3.8.2 Private Attribute View Key Enumeration (CVSS 5.3)
- [CVE-2026-85585](https://cve.now/CVE-2026-85585.md): SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency (CVSS 8.7)
- [CVE-2026-85584](https://cve.now/CVE-2026-85584.md): SiYuan before v3.8.2 Denial of Service via Auth Throttle (CVSS 8.7)
- [CVE-2026-85583](https://cve.now/CVE-2026-85583.md): SiYuan before v3.8.2 Path Traversal via symlink in file API (CVSS 7.1)
- [CVE-2026-85582](https://cve.now/CVE-2026-85582.md): SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth (CVSS 7.1)
- [CVE-2026-85581](https://cve.now/CVE-2026-85581.md): SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration (CVSS 8.7)
- [CVE-2026-85580](https://cve.now/CVE-2026-85580.md): SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch (CVSS 7.1)
- [CVE-2026-85579](https://cve.now/CVE-2026-85579.md): SiYuan before v3.8.2 Information Disclosure via undoState (CVSS 5.3)
- [CVE-2026-85578](https://cve.now/CVE-2026-85578.md): SiYuan through 3.8.1 Authorization Bypass via getFile (CVSS 7.1)
- [CVE-2026-85175](https://cve.now/CVE-2026-85175.md): SiYuan before v3.8.2 TLS Private Key Disclosure via getFile (CVSS 8.7)
- [CVE-2026-85174](https://cve.now/CVE-2026-85174.md): SiYuan before v3.8.2 API Token Exposure via Log File (CVSS 8.7)
- [CVE-2026-84803](https://cve.now/CVE-2026-84803.md): SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist (CVSS 8.6)
- [CVE-2026-82654](https://cve.now/CVE-2026-82654.md): SiYuan before v3.8.1 Stored XSS via block name (CVSS 9.3)
- [CVE-2026-82653](https://cve.now/CVE-2026-82653.md): SiYuan before v3.8.1 Stored XSS via confirmDialog (CVSS 9.3)
- [CVE-2026-82652](https://cve.now/CVE-2026-82652.md): SiYuan before v3.8.1 Information Disclosure via Publish Access (CVSS 6.9)
- [CVE-2026-82651](https://cve.now/CVE-2026-82651.md): SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff (CVSS 6.9)
- [CVE-2026-82650](https://cve.now/CVE-2026-82650.md): SiYuan before v3.8.1 Path Traversal via /api/template/render (CVSS 5.9)
- [CVE-2026-82649](https://cve.now/CVE-2026-82649.md): SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path (CVSS 7.0)
- [CVE-2026-82234](https://cve.now/CVE-2026-82234.md): SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU (CVSS 8.4)
- [CVE-2026-82233](https://cve.now/CVE-2026-82233.md): SiYuan before v3.8.1 Path Traversal via asset.upload (CVSS 6.9)
- [CVE-2026-62204](https://cve.now/CVE-2026-62204.md): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install (CVSS 5.9)
- [CVE-2026-60084](https://cve.now/CVE-2026-60084.md): SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate (CVSS 8.4)
- [CVE-2026-60083](https://cve.now/CVE-2026-60083.md): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool (CVSS 6.9)
- [CVE-2026-59809](https://cve.now/CVE-2026-59809.md): SiYuan before v3.8.0 Secret Exfiltration via http\_request URL (CVSS 6.9)
- [CVE-2026-77086](https://cve.now/CVE-2026-77086.md): SiYuan before v3.7.4 Path Traversal via packageName (CVSS 9.4)
- [CVE-2026-75917](https://cve.now/CVE-2026-75917.md): SiYuan before v3.7.4 XSS-to-RCE via pathName.ts (CVSS 9.3)
- [CVE-2026-75916](https://cve.now/CVE-2026-75916.md): SiYuan XSS-to-RCE via unescaped block metadata in hint popup (CVSS 9.3)
- [CVE-2026-74906](https://cve.now/CVE-2026-74906.md): SiYuan before v3.7.4 Incorrect Authorization via Publish Access (CVSS 8.7)
- [CVE-2026-74905](https://cve.now/CVE-2026-74905.md): SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass (CVSS 6.9)
- [CVE-2026-74904](https://cve.now/CVE-2026-74904.md): SiYuan before v3.7.4 Missing Authorization via block API (CVSS 8.7)
- [CVE-2026-74903](https://cve.now/CVE-2026-74903.md): SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM (CVSS 5.3)
- [CVE-2026-74902](https://cve.now/CVE-2026-74902.md): SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload (CVSS 9.3)
- [CVE-2026-74868](https://cve.now/CVE-2026-74868.md): SiYuan before 3.7.4 Brute-Force Authentication via Publish Service (CVSS 8.7)
- [CVE-2026-74867](https://cve.now/CVE-2026-74867.md): SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth (CVSS 2.3)
- [CVE-2026-74802](https://cve.now/CVE-2026-74802.md): SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy (CVSS 7.1)
- [CVE-2026-74801](https://cve.now/CVE-2026-74801.md): SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe (CVSS 8.6)
- [CVE-2026-74800](https://cve.now/CVE-2026-74800.md): SiYuan before v3.7.4 Stored XSS via assets endpoint (CVSS 9.4)
- [CVE-2026-74799](https://cve.now/CVE-2026-74799.md): SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure (CVSS 9.2)
- [CVE-2026-74798](https://cve.now/CVE-2026-74798.md): SiYuan kernel Path Traversal via database\_clean MCP tool (CVSS 9.3)
- [CVE-2026-73056](https://cve.now/CVE-2026-73056.md): SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token (CVSS 9.3)
- [CVE-2026-73054](https://cve.now/CVE-2026-73054.md): SiYuan before v3.7.4 Authentication Bypass via WebSocket (CVSS 8.7)
- [CVE-2026-73053](https://cve.now/CVE-2026-73053.md): SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji (CVSS 9.4)
- [CVE-2026-73052](https://cve.now/CVE-2026-73052.md): SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names (CVSS 9.4)
- [CVE-2026-73050](https://cve.now/CVE-2026-73050.md): SiYuan before v3.7.4 Stored XSS via select option color (CVSS 9.4)
- [CVE-2026-73047](https://cve.now/CVE-2026-73047.md): siyuan before v3.7.4 Server-Side Template Injection via attribute-view (CVSS 8.6)
- [CVE-2026-73046](https://cve.now/CVE-2026-73046.md): SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth (CVSS 9.3)
- [CVE-2026-73045](https://cve.now/CVE-2026-73045.md): SiYuan before 3.7.4 Brute-Force via authFilePublishAccess (CVSS 8.7)
- [CVE-2026-73044](https://cve.now/CVE-2026-73044.md): SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width (CVSS 9.4)
- [CVE-2026-73043](https://cve.now/CVE-2026-73043.md): SiYuan before v3.7.4 Remote Code Execution via Template Calculation (CVSS 9.4)
- [CVE-2026-73042](https://cve.now/CVE-2026-73042.md): SiYuan before v3.7.4 Remote Code Execution via Menu Metadata (CVSS 9.4)
- [CVE-2026-73041](https://cve.now/CVE-2026-73041.md): SiYuan before v3.7.4 Remote Code Execution via PDF Annotations (CVSS 9.4)
- [CVE-2026-73630](https://cve.now/CVE-2026-73630.md): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess (CVSS 6.9)
- [CVE-2026-73049](https://cve.now/CVE-2026-73049.md): SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks (CVSS 6.9)
- [CVE-2026-73048](https://cve.now/CVE-2026-73048.md): SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID (CVSS 6.9)
- [CVE-2026-72812](https://cve.now/CVE-2026-72812.md): SiYuan before v3.7.4 Missing Authorization via refreshBacklink (CVSS 6.9)
- [CVE-2026-72811](https://cve.now/CVE-2026-72811.md): SiYuan before v3.7.4 SQL Injection via backlink search (CVSS 9.9)
- [CVE-2026-72810](https://cve.now/CVE-2026-72810.md): SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket (CVSS 9.2)
- [CVE-2026-73610](https://cve.now/CVE-2026-73610.md): SiYuan before v3.7.4 Information Disclosure via Local Storage (CVSS 6.9)
- [CVE-2026-73609](https://cve.now/CVE-2026-73609.md): SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels (CVSS 6.9)
- [CVE-2026-73608](https://cve.now/CVE-2026-73608.md): SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget (CVSS 9.2)
- [CVE-2026-73607](https://cve.now/CVE-2026-73607.md): SiYuan before v3.7.4 Information Disclosure via getOutlineStorage (CVSS 6.9)
- [CVE-2026-73606](https://cve.now/CVE-2026-73606.md): SiYuan before v3.7.4 Information Disclosure via getRefIDs (CVSS 6.9)
- [CVE-2026-73605](https://cve.now/CVE-2026-73605.md): SiYuan before v3.7.4 Path Traversal via getUniqueFilename (CVSS 6.9)
- [CVE-2026-72809](https://cve.now/CVE-2026-72809.md): SiYuan before v3.7.4 Authentication Bypass via Localhost Trust (CVSS 7.1)
- [CVE-2026-72808](https://cve.now/CVE-2026-72808.md): SiYuan before v3.7.4 Information Disclosure via getFileAnnotation (CVSS 6.9)
- [CVE-2026-72807](https://cve.now/CVE-2026-72807.md): SiYuan before v3.7.4 SQL Injection via queryBlocks template (CVSS 8.8)
- [CVE-2026-72806](https://cve.now/CVE-2026-72806.md): SiYuan before v3.7.4 Authentication Bypass via Attribute View (CVSS 6.9)
- [CVE-2026-72805](https://cve.now/CVE-2026-72805.md): SiYuan before v3.7.4 Information Disclosure via Block Endpoints (CVSS 6.9)
- [CVE-2026-72804](https://cve.now/CVE-2026-72804.md): SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints (CVSS 9.2)
- [CVE-2026-72803](https://cve.now/CVE-2026-72803.md): SiYuan before v3.7.4 Information Disclosure via getBlockAttrs (CVSS 6.9)
- [CVE-2026-72802](https://cve.now/CVE-2026-72802.md): SiYuan before v3.7.4 Information Disclosure via resolveAssetPath (CVSS 6.9)
- [CVE-2026-72801](https://cve.now/CVE-2026-72801.md): SiYuan before v3.7.4 Information Disclosure via Encryption Key Material (CVSS 8.7)
- [CVE-2026-72800](https://cve.now/CVE-2026-72800.md): SiYuan before v3.7.4 Information Disclosure via Unfiltered API (CVSS 6.9)
- [CVE-2026-72799](https://cve.now/CVE-2026-72799.md): SiYuan before v3.7.4 Information Disclosure via Path Resolution (CVSS 6.9)
- [CVE-2026-72798](https://cve.now/CVE-2026-72798.md): SiYuan before v3.7.4 Information Disclosure via renderAttributeView (CVSS 9.2)
- [CVE-2026-72797](https://cve.now/CVE-2026-72797.md): SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus (CVSS 6.9)
- [CVE-2026-72796](https://cve.now/CVE-2026-72796.md): SiYuan before v3.7.4 Access Control Bypass via Static Routes (CVSS 6.9)
- [CVE-2026-72795](https://cve.now/CVE-2026-72795.md): SiYuan before v3.7.4 Information Disclosure via Embed Block (CVSS 9.2)
- [CVE-2026-72794](https://cve.now/CVE-2026-72794.md): siyuan before v3.7.4 Session Cookie Key Disclosure via getConf (CVSS 9.2)
- [CVE-2026-72793](https://cve.now/CVE-2026-72793.md): SiYuan before v3.7.4 Information Disclosure via /api/system/getConf (CVSS 9.2)
- [CVE-2026-72792](https://cve.now/CVE-2026-72792.md): SiYuan before v3.7.4 Information Disclosure via Tag API (CVSS 6.9)
- [CVE-2026-72791](https://cve.now/CVE-2026-72791.md): SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews (CVSS 6.9)
- [CVE-2026-72790](https://cve.now/CVE-2026-72790.md): SiYuan before v3.7.4 Information Disclosure via getNotebookInfo (CVSS 6.9)
- [CVE-2026-72789](https://cve.now/CVE-2026-72789.md): SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks (CVSS 9.2)
- [CVE-2026-72788](https://cve.now/CVE-2026-72788.md): SiYuan before v3.7.4 Information Disclosure via UILayout Filter (CVSS 6.9)
- [CVE-2026-69086](https://cve.now/CVE-2026-69086.md): SiYuan before v3.7.3 Path Traversal via unvalidated avID (CVSS 8.3)
- [CVE-2026-69085](https://cve.now/CVE-2026-69085.md): SiYuan before v3.7.3 SQL Injection via searchDocs (CVSS 9.9)
- [CVE-2026-69084](https://cve.now/CVE-2026-69084.md): SiYuan before v3.7.3 SQL Injection via searchEmbedBlock (CVSS 9.9)
- [CVE-2026-69083](https://cve.now/CVE-2026-69083.md): SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent (CVSS 9.9)
- [CVE-2026-68587](https://cve.now/CVE-2026-68587.md): SiYuan before v3.7.3 Information Disclosure via getHeading\*Transaction (CVSS 9.2)
- [CVE-2026-68586](https://cve.now/CVE-2026-68586.md): SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc (CVSS 9.2)
- [CVE-2026-68585](https://cve.now/CVE-2026-68585.md): SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo (CVSS 6.9)
- [CVE-2026-68584](https://cve.now/CVE-2026-68584.md): SiYuan before v3.7.3 Authentication Bypass via Content Endpoints (CVSS 9.2)
- [CVE-2026-66396](https://cve.now/CVE-2026-66396.md): SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL (CVSS 9.3)
- [CVE-2026-66395](https://cve.now/CVE-2026-66395.md): SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol (CVSS 9.4)
- [CVE-2026-66394](https://cve.now/CVE-2026-66394.md): SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass (CVSS 9.3)
- [CVE-2026-66012](https://cve.now/CVE-2026-66012.md): SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP (CVSS 10.0)
- [CVE-2026-65607](https://cve.now/CVE-2026-65607.md): SiYuan before v3.7.2 Path Traversal via /export/temp/ (CVSS 7.1)
- [CVE-2026-65606](https://cve.now/CVE-2026-65606.md): SiYuan before v3.7.2 Cross-Site Scripting to RCE (CVSS 9.4)
- [CVE-2026-65605](https://cve.now/CVE-2026-65605.md): SiYuan before v3.7.2 Stored XSS to RCE via Attribute View (CVSS 9.4)
- [CVE-2026-59854](https://cve.now/CVE-2026-59854.md): SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace (CVSS 4.9)
- [CVE-2026-59853](https://cve.now/CVE-2026-59853.md): SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter) (CVSS 6.5)
- [CVE-2026-59855](https://cve.now/CVE-2026-59855.md): SiYuan: Store XSS To Rce via Asset.render (CVSS 8.6)
- [CVE-2026-59832](https://cve.now/CVE-2026-59832.md): SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db (CVSS 7.7)
- [CVE-2026-59833](https://cve.now/CVE-2026-59833.md): SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href) (CVSS 8.6)
- [CVE-2026-59834](https://cve.now/CVE-2026-59834.md): SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content (CVSS 7.5)
- [CVE-2026-55570](https://cve.now/CVE-2026-55570.md): SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped \`data-obj\` attribute (Bypass for CVE-2026-45375's patch) (CVSS 9.0)
- [CVE-2026-54759](https://cve.now/CVE-2026-54759.md): SiYuan: Lute HTML sanitizer allows \`\<iframe\>\` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client (CVSS 8.7)
- [CVE-2026-50551](https://cve.now/CVE-2026-50551.md): SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content (CVSS 9.9)
- [CVE-2026-54158](https://cve.now/CVE-2026-54158.md): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (CVSS 9.9)
- [CVE-2026-54070](https://cve.now/CVE-2026-54070.md): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers (CVSS 7.1)
- [CVE-2026-54069](https://cve.now/CVE-2026-54069.md): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (CVSS 9.2)
- [CVE-2026-54068](https://cve.now/CVE-2026-54068.md): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon (CVSS 5.9)
- [CVE-2026-54067](https://cve.now/CVE-2026-54067.md): SiYuan: Stored XSS to RCE via CSS-snippet \<style\> breakout in renderSnippet() (CVSS 9.9)
- [CVE-2026-54066](https://cve.now/CVE-2026-54066.md): SiYuan: Path Traversal via Double URL Encoding in /assets/\*path (publish mode arbitrary file─read) (CVSS 7.5)
- [CVE-2026-44670](https://cve.now/CVE-2026-44670.md): SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan (CVSS 9.4)
- [CVE-2026-44588](https://cve.now/CVE-2026-44588.md): SiYuan: URL-encoded title bypasses \`escapeAriaLabel\`, decoded by \`decodeURIComponent\` into a tooltip-XSS (CVSS 9.4)
- [CVE-2026-45147](https://cve.now/CVE-2026-45147.md): SiYuan: Broken access control in SiYuan \`/api/tag/getTag\` — Reader role can mutate \`Conf.Tag.Sort\` and persist to disk (CVSS 4.3)
- [CVE-2026-45148](https://cve.now/CVE-2026-45148.md): SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata (CVSS 4.3)
- [CVE-2026-45371](https://cve.now/CVE-2026-45371.md): SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs (CVSS 7.2)
- [CVE-2026-45375](https://cve.now/CVE-2026-45375.md): SiYuan: Bazaar marketplace renders unescaped package \`name\` and \`version\` metadata, allowing stored XSS and Electron code execution (CVSS 9.0)
- [CVE-2026-44586](https://cve.now/CVE-2026-44586.md): SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution (CVSS 8.3)
- [CVE-2026-41894](https://cve.now/CVE-2026-41894.md): SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in \`/export/\` Endpoint (CVSS 7.1)
- [CVE-2026-41421](https://cve.now/CVE-2026-41421.md): SiYuan Desktop Notification XSS Leads to Electron RCE (CVSS 8.8)
- [CVE-2026-40922](https://cve.now/CVE-2026-40922.md): SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066) (CVSS 5.3)
- [CVE-2026-40322](https://cve.now/CVE-2026-40322.md): SiYuan: Mermaid \`javascript:\` Link Injection Leads to Stored XSS and Electron RCE (CVSS 9.1)
- [CVE-2026-40318](https://cve.now/CVE-2026-40318.md): SiYuan: Publish Reader Path Traversal Delete via \`removeUnusedAttributeView\` (CVSS 8.5)
- [CVE-2026-40259](https://cve.now/CVE-2026-40259.md): SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API (CVSS 8.1)
- [CVE-2026-40107](https://cve.now/CVE-2026-40107.md): SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering (CVSS 8.7)
- [CVE-2026-39846](https://cve.now/CVE-2026-39846.md): SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions (CVSS 9.1)
- [CVE-2026-34605](https://cve.now/CVE-2026-34605.md): SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated ) (CVSS 8.6)
- [CVE-2026-34585](https://cve.now/CVE-2026-34585.md): SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution (CVSS 8.6)
- [CVE-2026-34449](https://cve.now/CVE-2026-34449.md): SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection (CVSS 9.7)
- [CVE-2026-34448](https://cve.now/CVE-2026-34448.md): SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client (CVSS 9.1)
- [CVE-2026-34453](https://cve.now/CVE-2026-34453.md): SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content (CVSS 7.5)
- [CVE-2026-33670](https://cve.now/CVE-2026-33670.md): SiYuan has directory traversal within its publishing service (CVSS 9.8)
- [CVE-2026-33669](https://cve.now/CVE-2026-33669.md): SiYuan has Arbitrary Document Reading within the Publishing Service (CVSS 9.8)
- [CVE-2026-33476](https://cve.now/CVE-2026-33476.md): SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal (CVSS 7.5)
- [CVE-2026-33203](https://cve.now/CVE-2026-33203.md): SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass (CVSS 7.5)
- [CVE-2026-33194](https://cve.now/CVE-2026-33194.md): SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (CVSS 6.8)
- [CVE-2026-33067](https://cve.now/CVE-2026-33067.md): SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata (CVSS 5.3)
- [CVE-2026-33066](https://cve.now/CVE-2026-33066.md): SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering (CVSS 5.3)
- [CVE-2026-32940](https://cve.now/CVE-2026-32940.md): SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) (CVSS 9.3)
- [CVE-2026-32938](https://cve.now/CVE-2026-32938.md): SiYuan has an Arbitrary File Read in its Desktop Publish Service (CVSS 9.9)
- [CVE-2026-32767](https://cve.now/CVE-2026-32767.md): SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API (CVSS 9.8)
- [CVE-2026-32815](https://cve.now/CVE-2026-32815.md): SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure (CVSS 5.3)
- [CVE-2026-32750](https://cve.now/CVE-2026-32750.md): SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes (CVSS 6.8)
- [CVE-2026-32751](https://cve.now/CVE-2026-32751.md): SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface (CVSS 5.1)
- [CVE-2026-32749](https://cve.now/CVE-2026-32749.md): SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write (CVSS 7.6)
- [CVE-2026-32747](https://cve.now/CVE-2026-32747.md): SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets (CVSS 6.8)
- [CVE-2026-32704](https://cve.now/CVE-2026-32704.md): SiYuan renderSprig: missing admin check allows any user to read full workspace DB (CVSS 6.5)
- [CVE-2026-32110](https://cve.now/CVE-2026-32110.md): SiYuan has a Full-Read SSRF via /api/network/forwardProxy (CVSS 8.3)
- [CVE-2026-31809](https://cve.now/CVE-2026-31809.md): SiYuan has a SVG Sanitizer Bypass via Whitespace in \`javascript:\` URI — Unauthenticated XSS (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/siyuan-note
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.