InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,495 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,495
Show in the list
Critical, last 7 days
359
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product siyuan_note:siyuan. Show all products

134 CVEs, showing 101 to 134PreviousPage 3 of 3
CVESeverityTitlePublished
CVE-2026-87810Medium 5.3Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87811High 7.3SiYuan before v3.8.2 Stored XSS via notebook template paths
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87812Medium 6.8SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87813High 7.3SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87814High 7.3SiYuan before v3.8.2 Stored XSS via Asset Preview
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87815High 8.7SiYuan before v3.8.2 Path Traversal via removeRiffDeck
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-92985High 8.8SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
Assigned by VulnCheck
Sep 17, 2026
CVE-2026-92986High 8.8SiYuan before 3.8.4 Cross-Site Scripting via Document Title
Assigned by VulnCheck
Sep 17, 2026
CVE-2026-93591High 7.6SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93921Medium 4.3SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93922High 8.8SiYuan through 3.8.4 Stored XSS via notebook names
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93923High 8.8SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-100633Medium 6.5SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100634Medium 4.7SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100635Medium 5.9SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100636High 7.6SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100637High 7.6SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100638High 7.6SiYuan before v3.8.4 Path Traversal via setNotebookIcon
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100639High 8.8SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100640Medium 4.7SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100641High 8.0SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100642High 7.6SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100643High 8.0SiYuan before v3.8.4 Stored XSS via Attribute View textarea
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100644High 7.5SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100645High 8.0SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100646High 8.1SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-101091High 7.1SiYuan before v3.8.4 SQL Injection via Block Query Embed
Assigned by VulnCheck
Sep 28, 2026
CVE-2026-101092Medium 5.3SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
Assigned by VulnCheck
Sep 28, 2026
CVE-2026-103762Medium 5.3SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-103763Medium 5.8SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104410High 7.5SiYuan before 3.8.5 Information Disclosure via /api/export/preview
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-105205Medium 5.3SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-109309Medium 6.5SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-109310Medium 6.5SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
Assigned by VulnCheck
Oct 12, 2026
PreviousPage 3 of 3

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.