Vulnerabilities in siyuan-note
220 resultsCVE-2026-33067MEDIUMSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package MetadataEPSS 0.6%CVE-2026-66395CRITICALSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan ProtocolEPSS 0.6%CVE-2026-32767CRITICALSiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search APIEPSS 0.6%CVE-2026-31809MEDIUMSiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSSEPSS 0.6%CVE-2026-50551CRITICALSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentEPSS 0.6%CVE-2026-100634MEDIUMSiYuan before v3.8.4 Missing Authorization via siyuan-send-windowsEPSS 0.6%CVE-2026-39846CRITICALSiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsEPSS 0.6%CVE-2026-100637HIGHSiYuan before v3.8.4 Path Traversal via checkoutRepo sessionIDEPSS 0.6%CVE-2026-100638HIGHSiYuan before v3.8.4 Path Traversal via setNotebookIconEPSS 0.6%CVE-2026-74799CRITICALSiYuan before 3.7.4 Unauthenticated Debug Endpoint Information DisclosureEPSS 0.5%CVE-2026-66396CRITICALSiYuan before v3.7.2 Stored XSS to RCE via title-img IALEPSS 0.5%CVE-2026-72810CRITICALSiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketEPSS 0.5%CVE-2026-68584CRITICALSiYuan before v3.7.3 Authentication Bypass via Content EndpointsEPSS 0.5%CVE-2026-33669CRITICALSiYuan has Arbitrary Document Reading within the Publishing ServiceEPSS 0.5%CVE-2026-69086HIGHSiYuan before v3.7.3 Path Traversal via unvalidated avIDEPSS 0.5%CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%CVE-2026-100643HIGHSiYuan before v3.8.4 Stored XSS via Attribute View textareaEPSS 0.5%CVE-2026-73045HIGHSiYuan before 3.7.4 Brute-Force via authFilePublishAccessEPSS 0.5%CVE-2026-73052CRITICALSiYuan before v3.7.4 Stored XSS via Attribute-View Field NamesEPSS 0.5%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.5%