Vulnerabilidades en siyuan-note

190 resultados
Análisis Vexday

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.1%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2026-69084CRITICALSiYuan before v3.7.3 SQL Injection via searchEmbedBlockEPSS 1.6%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 1.5%CVE-2026-34453HIGHSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentEPSS 1.5%CVE-2026-30869CRITICALSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageEPSS 1.1%CVE-2026-25539CRITICALSiYuan has Arbitrary File Write via /api/file/copyFile leading to RCEEPSS 1.0%CVE-2026-77086CRITICALSiYuan before v3.7.4 Path Traversal via packageNameEPSS 1.0%CVE-2026-32751MEDIUMSiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile InterfaceEPSS 0.8%CVE-2026-93922HIGHSiYuan through 3.8.4 Stored XSS via notebook namesEPSS 0.8%CVE-2026-92986HIGHSiYuan before 3.8.4 Cross-Site Scripting via Document TitleEPSS 0.8%CVE-2026-92985HIGHSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsEPSS 0.8%CVE-2026-34449CRITICALSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionEPSS 0.8%CVE-2026-23852MEDIUMSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attributeEPSS 0.8%CVE-2026-73056CRITICALSiYuan kernel before 3.7.4 Unthrottled Brute-Force via API TokenEPSS 0.8%CVE-2026-65605CRITICALSiYuan before v3.7.2 Stored XSS to RCE via Attribute ViewEPSS 0.8%CVE-2026-73046CRITICALSiYuan before v3.7.4 Authentication Bypass via HTTP Basic AuthEPSS 0.8%CVE-2026-65606CRITICALSiYuan before v3.7.2 Cross-Site Scripting to RCEEPSS 0.8%CVE-2026-50551CRITICALSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentEPSS 0.8%CVE-2026-66012CRITICALSiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCPEPSS 0.8%