Vulnerabilities in siyuan-note
220 resultsCVE-2026-93921MEDIUMSiYuan through 3.8.4 Access Control Bypass via Dynamic Icon EndpointEPSS 0.4%CVE-2026-72812MEDIUMSiYuan before v3.7.4 Missing Authorization via refreshBacklinkEPSS 0.4%CVE-2026-74906HIGHSiYuan before v3.7.4 Incorrect Authorization via Publish AccessEPSS 0.4%CVE-2026-32110HIGHSiYuan has a Full-Read SSRF via /api/network/forwardProxyEPSS 0.4%CVE-2026-72788MEDIUMSiYuan before v3.7.4 Information Disclosure via UILayout FilterEPSS 0.4%CVE-2026-85578HIGHSiYuan through 3.8.1 Authorization Bypass via getFileEPSS 0.4%CVE-2026-41894HIGHSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` EndpointEPSS 0.4%CVE-2026-72789CRITICALSiYuan before v3.7.4 Authentication Bypass via Encrypted NotebooksEPSS 0.4%CVE-2026-87813HIGHSiYuan before v3.8.2 Stored XSS via unescaped asset filenamesEPSS 0.4%CVE-2026-87811HIGHSiYuan before v3.8.2 Stored XSS via notebook template pathsEPSS 0.4%CVE-2026-29073MEDIUMSiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessEPSS 0.4%CVE-2026-87814HIGHSiYuan before v3.8.2 Stored XSS via Asset PreviewEPSS 0.4%CVE-2026-82653CRITICALSiYuan before v3.8.1 Stored XSS via confirmDialogEPSS 0.4%CVE-2026-82654CRITICALSiYuan before v3.8.1 Stored XSS via block nameEPSS 0.4%CVE-2026-87812HIGHSiYuan before v3.8.2 Stored XSS via Bazaar iconURLEPSS 0.4%CVE-2026-82234HIGHSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUEPSS 0.4%CVE-2026-116170MEDIUMSiYuan before v3.8.7 SQL Injection via History Search op and queryEPSS 0.4%CVE-2026-54158CRITICALSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()EPSS 0.4%CVE-2026-86192HIGHSiYuan before v3.8.2 Information Disclosure via Attribute-ViewEPSS 0.4%CVE-2026-87809HIGHSiyuan before v3.8.2 Information Disclosure via Export PreviewEPSS 0.4%