Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73050SiYuan before v3.7.4 Stored XSS via select option color
- CVE-2026-73047siyuan before v3.7.4 Server-Side Template Injection via attribute-view
- CVE-2026-73046SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
- CVE-2026-73045SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
- CVE-2026-73044SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width
- CVE-2026-73043SiYuan before v3.7.4 Remote Code Execution via Template Calculation
- CVE-2026-73042SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
- CVE-2026-73041SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
- CVE-2026-73048SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID
- CVE-2026-72812SiYuan before v3.7.4 Missing Authorization via refreshBacklink
- CVE-2026-72811SiYuan before v3.7.4 SQL Injection via backlink search
- CVE-2026-72810SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
- CVE-2026-73610SiYuan before v3.7.4 Information Disclosure via Local Storage
- CVE-2026-73609SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels
- CVE-2026-73608SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget
- CVE-2026-73607SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
- CVE-2026-73606SiYuan before v3.7.4 Information Disclosure via getRefIDs
- CVE-2026-73605SiYuan before v3.7.4 Path Traversal via getUniqueFilename
- CVE-2026-72809SiYuan before v3.7.4 Authentication Bypass via Localhost Trust
- CVE-2026-72808SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
- CVE-2026-72807SiYuan before v3.7.4 SQL Injection via queryBlocks template
- CVE-2026-72806SiYuan before v3.7.4 Authentication Bypass via Attribute View
- CVE-2026-72805SiYuan before v3.7.4 Information Disclosure via Block Endpoints
- CVE-2026-72804SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
- CVE-2026-72803SiYuan before v3.7.4 Information Disclosure via getBlockAttrs
- CVE-2026-72802SiYuan before v3.7.4 Information Disclosure via resolveAssetPath
- CVE-2026-72801SiYuan before v3.7.4 Information Disclosure via Encryption Key Material
- CVE-2026-72800SiYuan before v3.7.4 Information Disclosure via Unfiltered API