Vulnerabilities in siyuan-note

190 results
Vexday analysis

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-72806MEDIUMSiYuan before v3.7.4 Authentication Bypass via Attribute ViewEPSS 0.4%CVE-2026-72804CRITICALSiYuan before v3.7.4 Authentication Bypass via Graph EndpointsEPSS 0.4%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.4%CVE-2026-73041CRITICALSiYuan before v3.7.4 Remote Code Execution via PDF AnnotationsEPSS 0.4%CVE-2026-73044CRITICALSiYuan before v3.7.4 Stored Cross-Site Scripting via Column WidthEPSS 0.4%CVE-2026-73050CRITICALSiYuan before v3.7.4 Stored XSS via select option colorEPSS 0.4%CVE-2026-74800CRITICALSiYuan before v3.7.4 Stored XSS via assets endpointEPSS 0.4%CVE-2026-84803HIGHSiYuan before v3.8.2 Stored XSS via incomplete asset blocklistEPSS 0.4%CVE-2026-72794CRITICALsiyuan before v3.7.4 Session Cookie Key Disclosure via getConfEPSS 0.4%CVE-2026-68587CRITICALSiYuan before v3.7.3 Information Disclosure via getHeading*TransactionEPSS 0.4%CVE-2026-59809MEDIUMSiYuan before v3.8.0 Secret Exfiltration via http_request URLEPSS 0.4%CVE-2026-72788MEDIUMSiYuan before v3.7.4 Information Disclosure via UILayout FilterEPSS 0.4%CVE-2026-45375CRITICALSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionEPSS 0.4%CVE-2026-72795CRITICALSiYuan before v3.7.4 Information Disclosure via Embed BlockEPSS 0.4%CVE-2026-68586CRITICALSiYuan before v3.7.3 Content Disclosure via getBacklinkDocEPSS 0.4%CVE-2026-74906HIGHSiYuan before v3.7.4 Incorrect Authorization via Publish AccessEPSS 0.4%CVE-2026-73608CRITICALSiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTargetEPSS 0.4%CVE-2026-72793CRITICALSiYuan before v3.7.4 Information Disclosure via /api/system/getConfEPSS 0.4%CVE-2026-72801HIGHSiYuan before v3.7.4 Information Disclosure via Encryption Key MaterialEPSS 0.4%CVE-2026-59853MEDIUMSiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)EPSS 0.4%