Vulnerabilidades en siyuan-note
220 resultadosCVE-2026-73053CRITICALSiYuan before v3.7.4 Cross-Site Scripting via unicode2EmojiEPSS 0.5%CVE-2026-33194MEDIUMSiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /homeEPSS 0.5%CVE-2026-23851HIGHSiYuan Vulnerable to Arbitrary File Read via File Copy FunctionalityEPSS 0.5%CVE-2026-74868HIGHSiYuan before 3.7.4 Brute-Force Authentication via Publish ServiceEPSS 0.5%CVE-2026-44588CRITICALSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSEPSS 0.5%CVE-2026-44670CRITICALSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuanEPSS 0.5%CVE-2026-85585HIGHSiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrencyEPSS 0.5%CVE-2026-34449CRITICALSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionEPSS 0.5%CVE-2026-85174HIGHSiYuan before v3.8.2 API Token Exposure via Log FileEPSS 0.5%CVE-2026-74798CRITICALSiYuan kernel Path Traversal via database_clean MCP toolEPSS 0.5%CVE-2026-34448CRITICALSiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop clientEPSS 0.5%CVE-2026-31807MEDIUMSiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSEPSS 0.5%CVE-2026-59833HIGHSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)EPSS 0.5%CVE-2026-59854MEDIUMSiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspaceEPSS 0.5%CVE-2026-59834HIGHSiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentEPSS 0.5%CVE-2026-116171MEDIUMSiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length PrefixEPSS 0.5%CVE-2026-87815HIGHSiYuan before v3.8.2 Path Traversal via removeRiffDeckEPSS 0.5%CVE-2026-82651MEDIUMSiYuan before v3.8.1 Missing Authorization via /history and /repo/diffEPSS 0.5%CVE-2026-69083CRITICALSiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentEPSS 0.5%CVE-2026-100639HIGHSiYuan before v3.8.4 Cross-Site Scripting via Kramdown IALEPSS 0.5%