siyuan-note siyuan

• CVE-2026-72812 Medium 6.5 SiYuan before v3.7.4 Missing Authorization via refreshBacklink 0.4%
• CVE-2026-72811 Critical 10.0 SiYuan before v3.7.4 SQL Injection via backlink search 0.4%
• CVE-2026-72810 High 8.6 SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket 0.5%
• CVE-2026-73610 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via Local Storage 0.3%
• CVE-2026-73609 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels 0.3%
• CVE-2026-73608 High 8.6 SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget 0.3%
• CVE-2026-73607 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getOutlineStorage 0.3%
• CVE-2026-73606 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getRefIDs 0.3%
• CVE-2026-73605 Medium 5.8 SiYuan before v3.7.4 Path Traversal via getUniqueFilename 0.3%
• CVE-2026-72809 High 8.0 SiYuan before v3.7.4 Authentication Bypass via Localhost Trust 0.3%
• CVE-2026-72808 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation 0.4%
• CVE-2026-72807 High 8.0 SiYuan before v3.7.4 SQL Injection via queryBlocks template 0.3%
• CVE-2026-72806 Medium 5.8 SiYuan before v3.7.4 Authentication Bypass via Attribute View 0.4%
• CVE-2026-72805 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via Block Endpoints 0.3%
• CVE-2026-72804 High 8.6 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints 0.4%
• CVE-2026-72803 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getBlockAttrs 0.3%
• CVE-2026-72802 Medium 5.3 SiYuan before v3.7.4 Information Disclosure via resolveAssetPath 0.3%
• CVE-2026-72801 High 7.5 SiYuan before v3.7.4 Information Disclosure via Encryption Key Material 0.3%
• CVE-2026-72800 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via Unfiltered API 0.3%
• CVE-2026-72799 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via Path Resolution 0.3%
• CVE-2026-72798 High 8.6 SiYuan before v3.7.4 Information Disclosure via renderAttributeView 0.4%
• CVE-2026-72797 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus 0.3%
• CVE-2026-72796 Medium 5.8 SiYuan before v3.7.4 Access Control Bypass via Static Routes 0.4%
• CVE-2026-72795 High 8.6 SiYuan before v3.7.4 Information Disclosure via Embed Block 0.3%
• CVE-2026-72794 High 8.6 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf 0.3%
• CVE-2026-72793 High 8.6 SiYuan before v3.7.4 Information Disclosure via /api/system/getConf 0.3%
• CVE-2026-72792 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via Tag API 0.3%
• CVE-2026-72791 Medium 5.8 SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews 0.3%
• CVE-2026-72790 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via getNotebookInfo 0.3%
• CVE-2026-72789 High 8.6 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks 0.4%
• CVE-2026-72788 Medium 5.8 SiYuan before v3.7.4 Information Disclosure via UILayout Filter 0.4%
• CVE-2026-69086 High 7.7 SiYuan before v3.7.3 Path Traversal via unvalidated avID 0.5%
• CVE-2026-69085 Critical 10.0 SiYuan before v3.7.3 SQL Injection via searchDocs 1.4%
• CVE-2026-69084 Critical 10.0 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock 1.6%
• CVE-2026-69083 Critical 10.0 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent 0.5%
• CVE-2026-68587 High 8.6 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction 0.3%
• CVE-2026-68586 High 8.6 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc 0.4%
• CVE-2026-68585 Medium 5.8 SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo 0.2%
• CVE-2026-68584 High 8.6 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints 0.5%
• CVE-2026-66396 High 8.4 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL 0.5%
• CVE-2026-66395 Critical 9.6 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol 0.6%
• CVE-2026-66394 High 8.7 SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass 0.3%
• CVE-2026-66012 Critical 10.0 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP 0.8%
• CVE-2026-65607 Medium 6.5 SiYuan before v3.7.2 Path Traversal via /export/temp/ 0.6%
• CVE-2026-65606 Critical 9.6 SiYuan before v3.7.2 Cross-Site Scripting to RCE 0.8%
• CVE-2026-65605 Critical 9.6 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View 0.8%
• CVE-2026-59854 Medium 4.9 SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace 0.5%
• CVE-2026-59853 Medium 6.5 SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter) 0.3%
• CVE-2026-59855 High 8.6 SiYuan: Store XSS To Rce via Asset.render 0.4%
• CVE-2026-59832 High 7.7 SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db 0.5%