What’s Vulnerable › Products

siyuan-note siyuan vulnerabilities

226 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 216 published in the last 12 months.

Check whether your siyuan-note siyuan version is affected

Latest siyuan-note siyuan vulnerabilities

• CVE-2026-118680 — SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias (CVSS 4.4)
• CVE-2026-116168 — SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool (CVSS 6.2)
• CVE-2026-116171 — SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix (CVSS 4.4)
• CVE-2026-116170 — SiYuan before v3.8.7 SQL Injection via History Search op and query (CVSS 4.9)
• CVE-2026-116169 — SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks (CVSS 5.4)
• CVE-2026-116167 — SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter (CVSS 6.8)
• CVE-2026-116166 — SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting (CVSS 6.8)
• CVE-2026-109310 — SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template (CVSS 6.5)
• CVE-2026-109309 — SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path (CVSS 6.5)
• CVE-2026-105205 — SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo (CVSS 5.3)
• CVE-2026-104410 — SiYuan before 3.8.5 Information Disclosure via /api/export/preview (CVSS 7.5)
• CVE-2026-103763 — SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo (CVSS 5.8)
• CVE-2026-103762 — SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints (CVSS 5.3)
• CVE-2026-101092 — SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages (CVSS 5.3)
• CVE-2026-101091 — SiYuan before v3.8.4 SQL Injection via Block Query Embed (CVSS 7.1)
• CVE-2026-100646 — SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header (CVSS 8.1)
• CVE-2026-100645 — SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban (CVSS 8.0)
• CVE-2026-100644 — SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath (CVSS 7.5)
• CVE-2026-100643 — SiYuan before v3.8.4 Stored XSS via Attribute View textarea (CVSS 8.0)
• CVE-2026-100642 — SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth (CVSS 7.6)
• CVE-2026-100641 — SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content (CVSS 8.0)
• CVE-2026-100640 — SiYuan before v3.8.4 Clipboard Data Disclosure via IPC (CVSS 4.7)
• CVE-2026-100639 — SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL (CVSS 8.8)
• CVE-2026-100638 — SiYuan before v3.8.4 Path Traversal via setNotebookIcon (CVSS 7.6)
• CVE-2026-100637 — SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID (CVSS 7.6)