InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product siyuan_note:siyuan. Show all products

134 CVEs, showing 51 to 100PreviousPage 2 of 3Next
CVESeverityTitlePublished
CVE-2026-73047Medium 6.2siyuan before v3.7.4 Server-Side Template Injection via attribute-view
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73050Critical 9.0SiYuan before v3.7.4 Stored XSS via select option color
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73052Critical 9.0SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73053Critical 9.0SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73054High 7.5SiYuan before v3.7.4 Authentication Bypass via WebSocket
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73056Critical 9.8SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
Assigned by VulnCheck
Aug 16, 2026
CVE-2026-74798High 8.7SiYuan kernel Path Traversal via database_clean MCP tool
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74799Critical 9.3SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74800Critical 9.0SiYuan before v3.7.4 Stored XSS via assets endpoint
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74801High 8.2SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74802High 8.2SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74867Medium 4.2SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74868High 7.5SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74902High 8.6SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74903Medium 4.3SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74904High 7.5SiYuan before v3.7.4 Missing Authorization via block API
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74905High 7.1SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74906High 7.5SiYuan before v3.7.4 Incorrect Authorization via Publish Access
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-75916High 8.6SiYuan XSS-to-RCE via unescaped block metadata in hint popup
Assigned by VulnCheck
Aug 19, 2026
CVE-2026-75917High 8.6SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Assigned by VulnCheck
Aug 19, 2026
CVE-2026-77086Critical 9.1SiYuan before v3.7.4 Path Traversal via packageName
Assigned by VulnCheck
Aug 21, 2026
CVE-2026-59809Medium 4.9SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-60083Medium 4.9SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-60084High 8.7SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-62204Medium 6.6SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-82233Medium 5.7SiYuan before v3.8.1 Path Traversal via asset.upload
Assigned by VulnCheck
Aug 28, 2026
CVE-2026-82234High 8.2SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
Assigned by VulnCheck
Aug 28, 2026
CVE-2026-82649High 7.0SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82650Medium 4.4SiYuan before v3.8.1 Path Traversal via /api/template/render
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82651Medium 4.9SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82652Medium 5.3SiYuan before v3.8.1 Information Disclosure via Publish Access
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82653High 8.9SiYuan before v3.8.1 Stored XSS via confirmDialog
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82654High 8.9SiYuan before v3.8.1 Stored XSS via block name
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-84803Critical 9.0SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
Assigned by VulnCheck
Sep 2, 2026
CVE-2026-85174High 8.8SiYuan before v3.8.2 API Token Exposure via Log File
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-85175High 8.8SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-85578Medium 6.5SiYuan through 3.8.1 Authorization Bypass via getFile
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85579Medium 4.3SiYuan before v3.8.2 Information Disclosure via undoState
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85580Medium 6.5SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85581High 7.5SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85582Medium 6.5SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85583Medium 6.5SiYuan before v3.8.2 Path Traversal via symlink in file API
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85584High 7.5SiYuan before v3.8.2 Denial of Service via Auth Throttle
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85585High 7.5SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-86191Medium 4.3SiYuan before v3.8.2 Private Attribute View Key Enumeration
Assigned by VulnCheck
Sep 5, 2026
CVE-2026-86192Medium 6.5SiYuan before v3.8.2 Information Disclosure via Attribute-View
Assigned by VulnCheck
Sep 5, 2026
CVE-2026-86712High 8.8SiYuan before 3.8.2 Remote Code Execution via Clipboard
Assigned by VulnCheck
Sep 8, 2026
CVE-2026-87807High 7.5siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87808Medium 4.9SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87809Medium 6.5Siyuan before v3.8.2 Information Disclosure via Export Preview
Assigned by VulnCheck
Sep 9, 2026
PreviousPage 2 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.