Vulnerabilidades em siyuan-note

190 resultados
Análise Vexday

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.3%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2026-34453HIGHSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentEPSS 1.2%CVE-2026-69084CRITICALSiYuan before v3.7.3 SQL Injection via searchEmbedBlockEPSS 1.1%CVE-2026-25539CRITICALSiYuan has Arbitrary File Write via /api/file/copyFile leading to RCEEPSS 1.0%CVE-2026-30869CRITICALSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageEPSS 1.0%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 0.9%CVE-2026-32751MEDIUMSiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile InterfaceEPSS 0.8%CVE-2026-23852MEDIUMSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attributeEPSS 0.8%CVE-2026-50551CRITICALSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentEPSS 0.8%CVE-2024-55657HIGHSiYuan has an arbitrary file read via /api/template/renderEPSS 0.7%CVE-2026-33670CRITICALSiYuan has directory traversal within its publishing serviceEPSS 0.7%CVE-2026-65606CRITICALSiYuan before v3.7.2 Cross-Site Scripting to RCEEPSS 0.6%CVE-2026-65605CRITICALSiYuan before v3.7.2 Stored XSS to RCE via Attribute ViewEPSS 0.6%CVE-2026-77086CRITICALSiYuan before v3.7.4 Path Traversal via packageNameEPSS 0.6%CVE-2026-29183CRITICALSiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionEPSS 0.6%CVE-2024-55660MEDIUMSiYuan has an SSTI via /api/template/renderSprigEPSS 0.6%CVE-2026-55570CRITICALSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)EPSS 0.6%CVE-2026-23850HIGHSiYuan vulnerable to arbitrary file readEPSS 0.6%CVE-2024-55658HIGHSiYuan has an arbitrary file read and path traversal via /api/export/exportResourcesEPSS 0.6%