Vulnerabilities in siyuan-note

220 results
CVE-2026-73049MEDIUMSiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinksEPSS 0.3%CVE-2026-73609MEDIUMSiYuan before v3.7.4 Information Disclosure via getBookmarkLabelsEPSS 0.3%CVE-2026-72799MEDIUMSiYuan before v3.7.4 Information Disclosure via Path ResolutionEPSS 0.3%CVE-2026-73048MEDIUMSiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationIDEPSS 0.3%CVE-2026-68587CRITICALSiYuan before v3.7.3 Information Disclosure via getHeading*TransactionEPSS 0.3%CVE-2026-40107HIGHSiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram RenderingEPSS 0.3%CVE-2026-45375CRITICALSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionEPSS 0.3%CVE-2026-93591HIGHSiYuan before 3.8.3 SQL Injection via unescaped tag in graph.goEPSS 0.3%CVE-2026-101091HIGHSiYuan before v3.8.4 SQL Injection via Block Query EmbedEPSS 0.3%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2026-23847LOWSiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconEPSS 0.3%CVE-2026-103763MEDIUMSiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfoEPSS 0.3%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.3%CVE-2026-40322CRITICALSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCEEPSS 0.3%CVE-2026-72801HIGHSiYuan before v3.7.4 Information Disclosure via Encryption Key MaterialEPSS 0.3%CVE-2026-73608CRITICALSiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetEPSS 0.3%CVE-2026-72793CRITICALSiYuan before v3.7.4 Information Disclosure via /api/system/getConfEPSS 0.3%CVE-2026-72795CRITICALSiYuan before v3.7.4 Information Disclosure via Embed BlockEPSS 0.3%CVE-2026-54070HIGHSiYuan: Stored XSS in Bazaar marketplace via package README event handlersEPSS 0.3%CVE-2026-72809HIGHSiYuan before v3.7.4 Authentication Bypass via Localhost TrustEPSS 0.3%