Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82653SiYuan before v3.8.1 Stored XSS via confirmDialog
- CVE-2026-82652SiYuan before v3.8.1 Information Disclosure via Publish Access
- CVE-2026-82651SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
- CVE-2026-82650SiYuan before v3.8.1 Path Traversal via /api/template/render
- CVE-2026-82649SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
- CVE-2026-82234SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
- CVE-2026-82233SiYuan before v3.8.1 Path Traversal via asset.upload
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
- CVE-2026-60084SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
- CVE-2026-59809SiYuan before v3.8.0 Secret Exfiltration via http_request URL
- CVE-2026-77086SiYuan before v3.7.4 Path Traversal via packageName
- CVE-2026-75917SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
- CVE-2026-75916SiYuan XSS-to-RCE via unescaped block metadata in hint popup
- CVE-2026-74906SiYuan before v3.7.4 Incorrect Authorization via Publish Access
- CVE-2026-74905SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
- CVE-2026-74904SiYuan before v3.7.4 Missing Authorization via block API
- CVE-2026-74903SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
- CVE-2026-74902SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
- CVE-2026-74868SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
- CVE-2026-74867SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth
- CVE-2026-74802SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
- CVE-2026-74801SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe
- CVE-2026-74800SiYuan before v3.7.4 Stored XSS via assets endpoint
- CVE-2026-74799SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
- CVE-2026-74798SiYuan kernel Path Traversal via database_clean MCP tool
- CVE-2026-73056SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocket
- CVE-2026-73053SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
- CVE-2026-73052SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names