Ssiyuan-note

Products

Exploited and recent CVEs

• CVE-2026-118680 Medium 4.4 SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias 0.5%
• CVE-2026-116171 Medium 4.4 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix 0.5%
• CVE-2026-116170 Medium 4.9 SiYuan before v3.8.7 SQL Injection via History Search op and query 0.4%
• CVE-2026-116169 Medium 5.4 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks 0.2%
• CVE-2026-116168 Medium 6.2 SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool 0.2%
• CVE-2026-116167 Medium 6.8 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter 0.7%
• CVE-2026-116166 Medium 6.8 SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting 0.1%
• CVE-2026-109310 Medium 6.5 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template 0.4%
• CVE-2026-109309 Medium 6.5 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path 0.4%
• CVE-2026-105205 Medium 5.3 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo 0.3%
• CVE-2026-104410 High 7.5 SiYuan before 3.8.5 Information Disclosure via /api/export/preview 0.4%
• CVE-2026-103763 Medium 5.8 SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo 0.3%
• CVE-2026-103762 Medium 5.3 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints 0.3%
• CVE-2026-101092 Medium 5.3 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages 0.3%
• CVE-2026-101091 High 7.1 SiYuan before v3.8.4 SQL Injection via Block Query Embed 0.3%
• CVE-2026-100646 High 8.1 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header 0.2%
• CVE-2026-100645 High 8.0 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban 0.4%
• CVE-2026-100644 High 7.5 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath 0.4%
• CVE-2026-100643 High 8.0 SiYuan before v3.8.4 Stored XSS via Attribute View textarea 0.5%
• CVE-2026-100642 High 7.6 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth 0.1%
• CVE-2026-100641 High 8.0 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content 0.7%
• CVE-2026-100640 Medium 4.7 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC 0.2%
• CVE-2026-100639 High 8.8 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL 0.5%
• CVE-2026-100638 High 7.6 SiYuan before v3.8.4 Path Traversal via setNotebookIcon 0.6%
• CVE-2026-100637 High 7.6 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID 0.6%
• CVE-2026-100636 High 7.6 SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder 0.6%
• CVE-2026-100635 Medium 5.9 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie 0.3%
• CVE-2026-100634 Medium 4.7 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows 0.6%
• CVE-2026-100633 Medium 6.5 SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations 0.4%
• CVE-2026-93923 High 8.8 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute 0.6%