siyuan-note siyuan

• CVE-2026-59833 High 8.6 SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href) 0.5%
• CVE-2026-59834 High 7.5 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content 0.5%
• CVE-2026-55570 Critical 9.0 SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch) 0.4%
• CVE-2026-54759 High 8.7 SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client 0.3%
• CVE-2026-50551 Critical 9.9 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content 0.6%
• CVE-2026-54158 Critical 9.9 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() 0.4%
• CVE-2026-54070 High 7.1 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers 0.3%
• CVE-2026-54069 Critical 9.2 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist 7.5%
• CVE-2026-54068 Medium 5.9 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon 4.3%
• CVE-2026-54067 Critical 9.9 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() 0.4%
• CVE-2026-54066 High 7.5 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read) 2.2%
• CVE-2026-44670 Critical 9.4 SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan 0.5%
• CVE-2026-44588 Critical 9.4 SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS 0.5%
• CVE-2026-45147 Medium 4.3 SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk 0.2%
• CVE-2026-45148 Medium 4.3 SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata 0.2%
• CVE-2026-45371 High 7.2 SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs 0.2%
• CVE-2026-45375 Critical 9.0 SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution 0.3%
• CVE-2026-44586 High 8.3 SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution 0.3%
• CVE-2026-41894 High 7.1 SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint 0.4%
• CVE-2026-41421 High 8.8 SiYuan Desktop Notification XSS Leads to Electron RCE 0.1%
• CVE-2026-40922 Medium 5.3 SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066) 0.3%
• CVE-2026-40322 Critical 9.1 SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE 0.3%
• CVE-2026-40318 High 8.5 SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` 0.3%
• CVE-2026-40259 High 8.1 SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API 0.4%
• CVE-2026-40107 High 8.7 SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering 0.3%
• CVE-2026-39846 Critical 9.1 SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions 0.6%
• CVE-2026-34605 High 8.6 SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated ) 0.5%
• CVE-2026-34585 High 8.6 SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution 0.3%
• CVE-2026-34449 Critical 9.7 SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection 0.5%
• CVE-2026-34448 Critical 9.1 SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client 0.5%
• CVE-2026-34453 High 7.5 SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content 1.2%
• CVE-2026-33670 Critical 9.8 SiYuan has directory traversal within its publishing service 0.7%
• CVE-2026-33669 Critical 9.8 SiYuan has Arbitrary Document Reading within the Publishing Service 0.5%
• CVE-2026-33476 High 7.5 SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal 3.3%
• CVE-2026-33203 High 7.5 SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass 0.5%
• CVE-2026-33194 Medium 6.8 SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home 0.5%
• CVE-2026-33067 Medium 5.3 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata 0.6%
• CVE-2026-33066 Medium 5.3 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering 0.6%
• CVE-2026-32940 Critical 9.3 SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) 0.3%
• CVE-2026-32938 Critical 9.9 SiYuan has an Arbitrary File Read in its Desktop Publish Service 0.4%
• CVE-2026-32767 Critical 9.8 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API 0.6%
• CVE-2026-32815 Medium 5.3 SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure 0.4%
• CVE-2026-32750 Medium 6.8 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes 0.5%
• CVE-2026-32751 Medium 5.1 SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface 0.8%
• CVE-2026-32749 High 7.6 SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write 0.5%
• CVE-2026-32747 Medium 6.8 SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets 0.4%
• CVE-2026-32704 Medium 6.5 SiYuan renderSprig: missing admin check allows any user to read full workspace DB 0.3%
• CVE-2026-32110 High 8.3 SiYuan has a Full-Read SSRF via /api/network/forwardProxy 0.4%
• CVE-2026-31809 Medium 6.4 SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS 0.6%
• CVE-2026-31807 Medium 6.4 SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS 0.5%