Browse CVEs

MEDIUM 5.4 CVE-2026-40922 SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incom… Siyuan 3.6.4+ Fix from $1,6002026-04-17 CRITICAL 9.0 CVE-2026-40322 SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "… Siyuan 3.6.4+ Fix from $2,3002026-04-16 HIGH 8.5 CVE-2026-40318 SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs… Siyuan 3.6.4+ Fix from $1,9502026-04-16 HIGH 8.1 CVE-2026-40259 SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protect… Siyuan 3.6.4+ Fix from $1,9502026-04-16 MEDIUM 6.5 CVE-2026-40107 SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In t… Siyuan 3.6.4+ Fix from $1,6002026-04-09 CRITICAL 9.0 CVE-2026-39846 SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the Si… Siyuan 3.6.4+ Fix from $2,3002026-04-07 HIGH 8.2 CVE-2026-34585 SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side… Siyuan 3.6.2+ Fix from $1,9502026-03-31 MEDIUM 6.1 CVE-2026-34605 SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to… Siyuan 3.6.2+ Fix from $1,6002026-03-31 HIGH 7.5 CVE-2026-34453 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected docum… Siyuan 3.6.2+ Fix from $1,9502026-03-31 CRITICAL 9.6 CVE-2026-34449 SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop … Siyuan 3.6.2+ Fix from $2,3002026-03-31 CRITICAL 9.0 CVE-2026-34448 SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field … Siyuan 3.6.2+ Fix from $2,3002026-03-31 HIGH 7.5 CVE-2026-33670 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file … Siyuan 3.6.2+ Fix from $1,9502026-03-26 HIGH 7.5 CVE-2026-33669 SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then t… Siyuan 3.6.2+ Fix from $1,9502026-03-26 HIGH 7.5 CVE-2026-33476 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/… Siyuan 3.6.2+ Fix from $1,9502026-03-20 HIGH 7.5 CVE-2026-33203 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when… Siyuan 3.6.2+ Fix from $1,9502026-03-20 MEDIUM 6.8 CVE-2026-33194 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist a… Siyuan 3.6.2+ Fix from $1,6002026-03-20 CRITICAL 9.0 CVE-2026-33066 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling SetS… Siyuan 3.6.1+ Fix from $2,3002026-03-20 CRITICAL 9.0 CVE-2026-33067 SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template l… Siyuan 3.6.1+ Fix from $2,3002026-03-20 MEDIUM 6.1 CVE-2026-32940 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and… Siyuan 3.6.1+ Fix from $1,6002026-03-20 MEDIUM 6.5 CVE-2026-32938 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed … Siyuan 3.6.1+ Fix from $1,6002026-03-20 CRITICAL 9.8 CVE-2026-32767 SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextS… Siyuan 3.6.1+ Fix from $2,3002026-03-20 HIGH 7.5 CVE-2026-32815 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when s… Siyuan 3.6.1+ Fix from $1,9502026-03-19 CRITICAL 9.0 CVE-2026-32751 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via inner… Siyuan 3.6.1+ Fix from $2,3002026-03-19 MEDIUM 6.8 CVE-2026-32750 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly t… Siyuan 3.6.1+ Fix from $1,6002026-03-19 CRITICAL 9.1 CVE-2026-32749 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploa… Siyuan 3.6.1+ Fix from $2,3002026-03-19 MEDIUM 6.5 CVE-2026-32704 SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticat… Siyuan 3.6.1+ Fix from $1,6002026-03-16 HIGH 8.3 CVE-2026-32110 SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary… Siyuan 3.6.0+ Fix from $1,9502026-03-11 MEDIUM 6.1 CVE-2026-31807 SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>… Siyuan 3.5.10+ Fix from $1,6002026-03-10 MEDIUM 6.1 CVE-2026-31809 SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: pr… Siyuan 3.5.10+ Fix from $1,6002026-03-10 CRITICAL 9.8 CVE-2026-30869 SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read … Siyuan 3.5.10+ Fix from $2,3002026-03-10