Vulnerabilities in siyuan-note

190 results
Vexday analysis

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-59855HIGHSiYuan: Store XSS To Rce via Asset.renderEPSS 0.5%CVE-2026-59833HIGHSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)EPSS 0.5%CVE-2026-32815MEDIUMSiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information DisclosureEPSS 0.5%CVE-2026-40322CRITICALSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCEEPSS 0.5%CVE-2026-73045HIGHSiYuan before 3.7.4 Brute-Force via authFilePublishAccessEPSS 0.5%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.5%CVE-2026-73052CRITICALSiYuan before v3.7.4 Stored XSS via Attribute-View Field NamesEPSS 0.5%CVE-2026-73053CRITICALSiYuan before v3.7.4 Cross-Site Scripting via unicode2EmojiEPSS 0.5%CVE-2026-33669CRITICALSiYuan has Arbitrary Document Reading within the Publishing ServiceEPSS 0.5%CVE-2026-32747MEDIUMSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secretsEPSS 0.5%CVE-2026-74868HIGHSiYuan before 3.7.4 Brute-Force Authentication via Publish ServiceEPSS 0.5%CVE-2026-54158CRITICALSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()EPSS 0.5%CVE-2026-85585HIGHSiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrencyEPSS 0.5%CVE-2026-59834HIGHSiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentEPSS 0.5%CVE-2026-85174HIGHSiYuan before v3.8.2 API Token Exposure via Log FileEPSS 0.5%CVE-2026-23851HIGHSiYuan Vulnerable to Arbitrary File Read via File Copy FunctionalityEPSS 0.5%CVE-2026-74798CRITICALSiYuan kernel Path Traversal via database_clean MCP toolEPSS 0.5%CVE-2026-74904HIGHSiYuan before v3.7.4 Missing Authorization via block APIEPSS 0.5%CVE-2026-72789CRITICALSiYuan before v3.7.4 Authentication Bypass via Encrypted NotebooksEPSS 0.5%CVE-2026-31807MEDIUMSiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSEPSS 0.5%