Vulnerabilidades en siyuan-note
220 resultadosCVE-2026-25647MEDIUMLute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlinkEPSS 0.2%CVE-2026-75916CRITICALSiYuan XSS-to-RCE via unescaped block metadata in hint popupEPSS 0.2%CVE-2026-75917CRITICALSiYuan before v3.7.4 XSS-to-RCE via pathName.tsEPSS 0.2%CVE-2025-68948MEDIUMSiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session SecretEPSS 0.2%CVE-2026-45148MEDIUMSiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadataEPSS 0.2%CVE-2026-45371HIGHSiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIsEPSS 0.2%CVE-2026-74801HIGHSiYuan before 3.7.4 Local Privilege Escalation via elevator.exeEPSS 0.2%CVE-2026-116169MEDIUMSiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math BlocksEPSS 0.2%CVE-2026-74902CRITICALSiYuan before v3.7.4 XSS-to-RCE via malicious filename uploadEPSS 0.2%CVE-2026-73047HIGHsiyuan before v3.7.4 Server-Side Template Injection via attribute-viewEPSS 0.2%CVE-2026-116168MEDIUMSiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset ToolEPSS 0.2%CVE-2026-82649HIGHSiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search PathEPSS 0.2%CVE-2026-74802HIGHSiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxyEPSS 0.2%CVE-2026-45147MEDIUMSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskEPSS 0.2%CVE-2026-41421HIGHSiYuan Desktop Notification XSS Leads to Electron RCEEPSS 0.1%CVE-2026-74867LOWSiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuthEPSS 0.1%CVE-2026-100642HIGHSiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuthEPSS 0.1%CVE-2026-116166HIGHSiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS SettingEPSS 0.1%CVE-2026-62204MEDIUMSiYuan before v3.7.4 Plugin Overwrite via Bazaar InstallEPSS 0.1%CVE-2026-123492MEDIUMSiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/readEPSS —