Vulnerabilidades em siyuan-note

190 resultados
Análise Vexday

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2026-65607HIGHSiYuan before v3.7.2 Path Traversal via /export/temp/EPSS 0.6%CVE-2026-33066MEDIUMSiYuan has Stored XSS to RCE via Unsanitized Bazaar README RenderingEPSS 0.6%CVE-2026-54069CRITICALSiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistEPSS 0.6%CVE-2026-66012CRITICALSiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCPEPSS 0.6%CVE-2026-33067MEDIUMSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package MetadataEPSS 0.5%CVE-2026-93922HIGHSiYuan through 3.8.4 Stored XSS via notebook namesEPSS 0.5%CVE-2026-54067CRITICALSiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()EPSS 0.5%CVE-2026-32767CRITICALSiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search APIEPSS 0.5%CVE-2026-39846CRITICALSiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsEPSS 0.5%CVE-2026-59833HIGHSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)EPSS 0.5%CVE-2026-59855HIGHSiYuan: Store XSS To Rce via Asset.renderEPSS 0.5%CVE-2026-85580HIGHSiYuan before v3.8.2 Path Guard Bypass via Case MismatchEPSS 0.5%CVE-2026-25992HIGHSiYuan has a File Read Interface Case Bypass VulnerabilityEPSS 0.5%CVE-2026-33669CRITICALSiYuan has Arbitrary Document Reading within the Publishing ServiceEPSS 0.5%CVE-2026-92985HIGHSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsEPSS 0.5%CVE-2026-44588CRITICALSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSEPSS 0.5%CVE-2026-44670CRITICALSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuanEPSS 0.5%CVE-2026-54158CRITICALSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()EPSS 0.5%CVE-2026-59834HIGHSiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentEPSS 0.5%