siyuan-note siyuan

• CVE-2026-85582 Medium 6.5 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth 0.4%
• CVE-2026-85581 High 7.5 SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration 0.6%
• CVE-2026-85580 Medium 6.5 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch 0.6%
• CVE-2026-85579 Medium 4.3 SiYuan before v3.8.2 Information Disclosure via undoState 0.3%
• CVE-2026-85578 Medium 6.5 SiYuan through 3.8.1 Authorization Bypass via getFile 0.4%
• CVE-2026-85175 High 8.8 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile 0.3%
• CVE-2026-85174 High 8.8 SiYuan before v3.8.2 API Token Exposure via Log File 0.5%
• CVE-2026-84803 Critical 9.0 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist 0.4%
• CVE-2026-82654 High 8.9 SiYuan before v3.8.1 Stored XSS via block name 0.4%
• CVE-2026-82653 High 8.9 SiYuan before v3.8.1 Stored XSS via confirmDialog 0.4%
• CVE-2026-82652 Medium 5.3 SiYuan before v3.8.1 Information Disclosure via Publish Access 0.3%
• CVE-2026-82651 Medium 4.9 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff 0.5%
• CVE-2026-82650 Medium 4.4 SiYuan before v3.8.1 Path Traversal via /api/template/render 0.4%
• CVE-2026-82649 High 7.0 SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path 0.2%
• CVE-2026-82234 High 8.2 SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU 0.4%
• CVE-2026-82233 Medium 5.7 SiYuan before v3.8.1 Path Traversal via asset.upload 0.4%
• CVE-2026-62204 Medium 6.6 SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install <0.1%
• CVE-2026-60084 High 8.7 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate 0.4%
• CVE-2026-60083 Medium 4.9 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool 0.4%
• CVE-2026-59809 Medium 4.9 SiYuan before v3.8.0 Secret Exfiltration via http_request URL 0.4%
• CVE-2026-77086 Critical 9.1 SiYuan before v3.7.4 Path Traversal via packageName 1.0%
• CVE-2026-75917 High 8.6 SiYuan before v3.7.4 XSS-to-RCE via pathName.ts 0.2%
• CVE-2026-75916 High 8.6 SiYuan XSS-to-RCE via unescaped block metadata in hint popup 0.2%
• CVE-2026-74906 High 7.5 SiYuan before v3.7.4 Incorrect Authorization via Publish Access 0.4%
• CVE-2026-74905 High 7.1 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass 0.4%
• CVE-2026-74904 High 7.5 SiYuan before v3.7.4 Missing Authorization via block API 0.4%
• CVE-2026-74903 Medium 4.3 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM 0.3%
• CVE-2026-74902 High 8.6 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload 0.2%
• CVE-2026-74868 High 7.5 SiYuan before 3.7.4 Brute-Force Authentication via Publish Service 0.5%
• CVE-2026-74867 Medium 4.2 SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth 0.1%
• CVE-2026-74802 High 8.2 SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy 0.2%
• CVE-2026-74801 High 8.2 SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe 0.2%
• CVE-2026-74800 Critical 9.0 SiYuan before v3.7.4 Stored XSS via assets endpoint 0.4%
• CVE-2026-74799 Critical 9.3 SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure 0.5%
• CVE-2026-74798 High 8.7 SiYuan kernel Path Traversal via database_clean MCP tool 0.5%
• CVE-2026-73056 Critical 9.8 SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token 0.8%
• CVE-2026-73054 High 7.5 SiYuan before v3.7.4 Authentication Bypass via WebSocket 0.4%
• CVE-2026-73053 Critical 9.0 SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji 0.5%
• CVE-2026-73052 Critical 9.0 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names 0.5%
• CVE-2026-73050 Critical 9.0 SiYuan before v3.7.4 Stored XSS via select option color 0.4%
• CVE-2026-73047 Medium 6.2 siyuan before v3.7.4 Server-Side Template Injection via attribute-view 0.2%
• CVE-2026-73046 Critical 9.8 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth 0.8%
• CVE-2026-73045 High 7.5 SiYuan before 3.7.4 Brute-Force via authFilePublishAccess 0.5%
• CVE-2026-73044 Critical 9.0 SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width 0.4%
• CVE-2026-73043 Critical 9.0 SiYuan before v3.7.4 Remote Code Execution via Template Calculation 0.6%
• CVE-2026-73042 Critical 9.0 SiYuan before v3.7.4 Remote Code Execution via Menu Metadata 0.5%
• CVE-2026-73041 Critical 9.0 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations 0.4%
• CVE-2026-73630 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess 0.3%
• CVE-2026-73049 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks 0.3%
• CVE-2026-73048 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID 0.3%