Vulnerabilities in siyuan-note
220 resultsCVE-2024-55657HIGHSiYuan has an arbitrary file read via /api/template/renderEPSS 0.7%CVE-2026-86712HIGHSiYuan before 3.8.2 Remote Code Execution via ClipboardEPSS 0.7%CVE-2026-29183CRITICALSiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionEPSS 0.7%CVE-2026-33670CRITICALSiYuan has directory traversal within its publishing serviceEPSS 0.7%CVE-2026-100641HIGHSiYuan before v3.8.4 Stored XSS via Unescaped Flashcard ContentEPSS 0.7%CVE-2026-116167HIGHSiYuan 2.9.0 before 3.8.7 XSS via check-auth to ParameterEPSS 0.7%CVE-2026-73043CRITICALSiYuan before v3.7.4 Remote Code Execution via Template CalculationEPSS 0.6%CVE-2026-85583HIGHSiYuan before v3.8.2 Path Traversal via symlink in file APIEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2024-55660MEDIUMSiYuan has an SSTI via /api/template/renderSprigEPSS 0.6%CVE-2026-23850HIGHSiYuan vulnerable to arbitrary file readEPSS 0.6%CVE-2026-100636HIGHSiYuan before v3.8.4 Path Traversal via exportBrowserHTML folderEPSS 0.6%CVE-2026-33066MEDIUMSiYuan has Stored XSS to RCE via Unsanitized Bazaar README RenderingEPSS 0.6%CVE-2024-55658HIGHSiYuan has an arbitrary file read and path traversal via /api/export/exportResourcesEPSS 0.6%CVE-2026-25992HIGHSiYuan has a File Read Interface Case Bypass VulnerabilityEPSS 0.6%CVE-2026-93923HIGHSiYuan through 3.8.4 Stored XSS via Heading Style AttributeEPSS 0.6%CVE-2026-85584HIGHSiYuan before v3.8.2 Denial of Service via Auth ThrottleEPSS 0.6%CVE-2026-65607HIGHSiYuan before v3.7.2 Path Traversal via /export/temp/EPSS 0.6%CVE-2026-85580HIGHSiYuan before v3.8.2 Path Guard Bypass via Case MismatchEPSS 0.6%CVE-2026-85581HIGHSiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationEPSS 0.6%