Vulnerabilidades em siyuan-note

190 resultados
Análise Vexday

O siyuan-note acumula 67 CVEs catalogadas, com 20 classificadas como críticas — volume que merece atenção, especialmente considerando que 29 dessas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo elevado de descobertas recentes. A falha mais frequente é CWE-79 (Cross-Site Scripting), padrão coerente com aplicações de edição de conteúdo que processam entrada de usuário de forma extensiva. Nenhuma CVE consta no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, e a ausência de PoCs públicas reduz a exposição imediata; contudo, a CVE mais perigosa atualmente identificada, CVE-2026-33476, registra EPSS de 0,0326, sinalizando probabilidade não nula de exploração que justifica monitoramento contínuo. Equipes responsáveis por instâncias do siyuan-note devem priorizar a aplicação de correções dado o volume expressivo de vulnerabilidades críticas acumuladas.

CVE-2026-85584HIGHSiYuan before v3.8.2 Denial of Service via Auth ThrottleEPSS 0.3%CVE-2026-87808HIGHSiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockEPSS 0.3%CVE-2026-29073MEDIUMSiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessEPSS 0.3%CVE-2026-82234HIGHSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUEPSS 0.3%CVE-2026-85581HIGHSiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationEPSS 0.3%CVE-2026-74905MEDIUMSiYuan before v3.7.4 SSRF via IPv6 Transition Address BypassEPSS 0.3%CVE-2026-45375CRITICALSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionEPSS 0.3%CVE-2026-41894HIGHSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` EndpointEPSS 0.3%CVE-2026-72810CRITICALSiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketEPSS 0.3%CVE-2026-73054HIGHSiYuan before v3.7.4 Authentication Bypass via WebSocketEPSS 0.3%CVE-2026-30926HIGHSiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentEPSS 0.3%CVE-2026-68584CRITICALSiYuan before v3.7.3 Authentication Bypass via Content EndpointsEPSS 0.3%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.3%CVE-2026-23847LOWSiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconEPSS 0.3%CVE-2026-72806MEDIUMSiYuan before v3.7.4 Authentication Bypass via Attribute ViewEPSS 0.3%CVE-2026-40107HIGHSiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram RenderingEPSS 0.3%CVE-2026-40322CRITICALSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCEEPSS 0.3%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2026-73045HIGHSiYuan before 3.7.4 Brute-Force via authFilePublishAccessEPSS 0.3%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.3%