Vulnerabilities in siyuan-note

190 results
Vexday analysis

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-82233MEDIUMSiYuan before v3.8.1 Path Traversal via asset.uploadEPSS 0.4%CVE-2026-72808MEDIUMSiYuan before v3.7.4 Information Disclosure via getFileAnnotationEPSS 0.4%CVE-2026-60083MEDIUMSiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolEPSS 0.4%CVE-2026-32110HIGHSiYuan has a Full-Read SSRF via /api/network/forwardProxyEPSS 0.4%CVE-2024-55659HIGHSiYuan has an arbitrary file write in the host via /api/asset/uploadEPSS 0.4%CVE-2026-93921MEDIUMSiYuan through 3.8.4 Access Control Bypass via Dynamic Icon EndpointEPSS 0.4%CVE-2026-40922MEDIUMSiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)EPSS 0.4%CVE-2026-72812MEDIUMSiYuan before v3.7.4 Missing Authorization via refreshBacklinkEPSS 0.4%CVE-2026-54068MEDIUMSiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconEPSS 0.4%CVE-2026-85578HIGHSiYuan through 3.8.1 Authorization Bypass via getFileEPSS 0.4%CVE-2026-87814HIGHSiYuan before v3.8.2 Stored XSS via Asset PreviewEPSS 0.4%CVE-2026-87813HIGHSiYuan before v3.8.2 Stored XSS via unescaped asset filenamesEPSS 0.4%CVE-2026-87811HIGHSiYuan before v3.8.2 Stored XSS via notebook template pathsEPSS 0.4%CVE-2026-82654CRITICALSiYuan before v3.8.1 Stored XSS via block nameEPSS 0.4%CVE-2026-82653CRITICALSiYuan before v3.8.1 Stored XSS via confirmDialogEPSS 0.4%CVE-2026-87812HIGHSiYuan before v3.8.2 Stored XSS via Bazaar iconURLEPSS 0.4%CVE-2026-82234HIGHSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUEPSS 0.4%CVE-2026-34585HIGHSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command executionEPSS 0.4%CVE-2026-86192HIGHSiYuan before v3.8.2 Information Disclosure via Attribute-ViewEPSS 0.4%CVE-2026-87809HIGHSiyuan before v3.8.2 Information Disclosure via Export PreviewEPSS 0.4%