Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-93923SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
- CVE-2026-93922SiYuan through 3.8.4 Stored XSS via notebook names
- CVE-2026-93921SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
- CVE-2026-93591SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
- CVE-2026-92986SiYuan before 3.8.4 Cross-Site Scripting via Document Title
- CVE-2026-92985SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
- CVE-2026-87815SiYuan before v3.8.2 Path Traversal via removeRiffDeck
- CVE-2026-87814SiYuan before v3.8.2 Stored XSS via Asset Preview
- CVE-2026-87813SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
- CVE-2026-87812SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- CVE-2026-87811SiYuan before v3.8.2 Stored XSS via notebook template paths
- CVE-2026-87810Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
- CVE-2026-87809Siyuan before v3.8.2 Information Disclosure via Export Preview
- CVE-2026-87808SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
- CVE-2026-87807siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
- CVE-2026-86712SiYuan before 3.8.2 Remote Code Execution via Clipboard
- CVE-2026-86192SiYuan before v3.8.2 Information Disclosure via Attribute-View
- CVE-2026-86191SiYuan before v3.8.2 Private Attribute View Key Enumeration
- CVE-2026-85585SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
- CVE-2026-85584SiYuan before v3.8.2 Denial of Service via Auth Throttle
- CVE-2026-85583SiYuan before v3.8.2 Path Traversal via symlink in file API
- CVE-2026-85582SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
- CVE-2026-85581SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
- CVE-2026-85580SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
- CVE-2026-85579SiYuan before v3.8.2 Information Disclosure via undoState
- CVE-2026-85578SiYuan through 3.8.1 Authorization Bypass via getFile
- CVE-2026-85175SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
- CVE-2026-85174SiYuan before v3.8.2 API Token Exposure via Log File
- CVE-2026-84803SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
- CVE-2026-82654SiYuan before v3.8.1 Stored XSS via block name