siyuan-note siyuan

• CVE-2026-118680 Medium 4.4 SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias 0.5%
• CVE-2026-116171 Medium 4.4 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix 0.5%
• CVE-2026-116170 Medium 4.9 SiYuan before v3.8.7 SQL Injection via History Search op and query 0.4%
• CVE-2026-116169 Medium 5.4 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks 0.2%
• CVE-2026-116168 Medium 6.2 SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool 0.2%
• CVE-2026-116167 Medium 6.8 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter 0.7%
• CVE-2026-116166 Medium 6.8 SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting 0.1%
• CVE-2026-109310 Medium 6.5 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template 0.4%
• CVE-2026-109309 Medium 6.5 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path 0.4%
• CVE-2026-105205 Medium 5.3 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo 0.3%
• CVE-2026-104410 High 7.5 SiYuan before 3.8.5 Information Disclosure via /api/export/preview 0.4%
• CVE-2026-103763 Medium 5.8 SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo 0.3%
• CVE-2026-103762 Medium 5.3 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints 0.3%
• CVE-2026-101092 Medium 5.3 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages 0.3%
• CVE-2026-101091 High 7.1 SiYuan before v3.8.4 SQL Injection via Block Query Embed 0.3%
• CVE-2026-100646 High 8.1 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header 0.2%
• CVE-2026-100645 High 8.0 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban 0.4%
• CVE-2026-100644 High 7.5 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath 0.4%
• CVE-2026-100643 High 8.0 SiYuan before v3.8.4 Stored XSS via Attribute View textarea 0.5%
• CVE-2026-100642 High 7.6 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth 0.1%
• CVE-2026-100641 High 8.0 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content 0.7%
• CVE-2026-100640 Medium 4.7 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC 0.2%
• CVE-2026-100639 High 8.8 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL 0.5%
• CVE-2026-100638 High 7.6 SiYuan before v3.8.4 Path Traversal via setNotebookIcon 0.6%
• CVE-2026-100637 High 7.6 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID 0.6%
• CVE-2026-100636 High 7.6 SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder 0.6%
• CVE-2026-100635 Medium 5.9 SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie 0.3%
• CVE-2026-100634 Medium 4.7 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows 0.6%
• CVE-2026-100633 Medium 6.5 SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations 0.4%
• CVE-2026-93923 High 8.8 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute 0.6%
• CVE-2026-93922 High 8.8 SiYuan through 3.8.4 Stored XSS via notebook names 0.8%
• CVE-2026-93921 Medium 4.3 SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint 0.4%
• CVE-2026-93591 High 7.6 SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go 0.3%
• CVE-2026-92986 High 8.8 SiYuan before 3.8.4 Cross-Site Scripting via Document Title 0.8%
• CVE-2026-92985 High 8.8 SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels 0.8%
• CVE-2026-87815 High 8.7 SiYuan before v3.8.2 Path Traversal via removeRiffDeck 0.5%
• CVE-2026-87814 High 7.3 SiYuan before v3.8.2 Stored XSS via Asset Preview 0.4%
• CVE-2026-87813 High 7.3 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames 0.4%
• CVE-2026-87812 Medium 6.8 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL 0.4%
• CVE-2026-87811 High 7.3 SiYuan before v3.8.2 Stored XSS via notebook template paths 0.4%
• CVE-2026-87810 Medium 5.3 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock 0.3%
• CVE-2026-87809 Medium 6.5 Siyuan before v3.8.2 Information Disclosure via Export Preview 0.4%
• CVE-2026-87808 Medium 4.9 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock 0.4%
• CVE-2026-87807 High 7.5 siyuan before v3.8.2 SQL Injection via fullTextSearchBlock 0.5%
• CVE-2026-86712 High 8.8 SiYuan before 3.8.2 Remote Code Execution via Clipboard 0.7%
• CVE-2026-86192 Medium 6.5 SiYuan before v3.8.2 Information Disclosure via Attribute-View 0.4%
• CVE-2026-86191 Medium 4.3 SiYuan before v3.8.2 Private Attribute View Key Enumeration 0.3%
• CVE-2026-85585 High 7.5 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency 0.5%
• CVE-2026-85584 High 7.5 SiYuan before v3.8.2 Denial of Service via Auth Throttle 0.6%
• CVE-2026-85583 Medium 6.5 SiYuan before v3.8.2 Path Traversal via symlink in file API 0.6%