Vulnerabilidades en siyuan-note
220 resultadosCVE-2026-34605HIGHSiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )EPSS 0.5%CVE-2026-59832HIGHSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbEPSS 0.5%CVE-2026-118680MEDIUMSiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT AliasEPSS 0.5%CVE-2026-32750MEDIUMSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notesEPSS 0.5%CVE-2026-32749HIGHSiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file writeEPSS 0.5%CVE-2026-87807HIGHsiyuan before v3.8.2 SQL Injection via fullTextSearchBlockEPSS 0.5%CVE-2026-74904HIGHSiYuan before v3.7.4 Missing Authorization via block APIEPSS 0.4%CVE-2026-87808HIGHSiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockEPSS 0.4%CVE-2025-67488HIGHSiYuan: ZipSlip -> Arbitrary File Overwrite -> RCEEPSS 0.4%CVE-2026-100645HIGHSiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery KanbanEPSS 0.4%CVE-2026-32747MEDIUMSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secretsEPSS 0.4%CVE-2026-72811CRITICALSiYuan before v3.7.4 SQL Injection via backlink searchEPSS 0.4%CVE-2026-85582HIGHSiYuan before v3.8.2 Unbounded Session Creation via Basic AuthEPSS 0.4%CVE-2026-72798CRITICALSiYuan before v3.7.4 Information Disclosure via renderAttributeViewEPSS 0.4%CVE-2026-100644HIGHSiYuan before v3.8.4 SQL Injection via dailyNoteSavePathEPSS 0.4%CVE-2026-72804CRITICALSiYuan before v3.7.4 Authentication Bypass via Graph EndpointsEPSS 0.4%CVE-2026-32938CRITICALSiYuan has an Arbitrary File Read in its Desktop Publish ServiceEPSS 0.4%CVE-2026-73041CRITICALSiYuan before v3.7.4 Remote Code Execution via PDF AnnotationsEPSS 0.4%CVE-2026-74800CRITICALSiYuan before v3.7.4 Stored XSS via assets endpointEPSS 0.4%CVE-2026-73050CRITICALSiYuan before v3.7.4 Stored XSS via select option colorEPSS 0.4%