InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,488 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,488
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product siyuan_note:siyuan. Show all products

134 CVEs, showing 51 to 100PreviousPage 2 of 3Next
CVESeverityTitlePublished
CVE-2026-84803Critical 9.0SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
Assigned by VulnCheck
Sep 2, 2026
CVE-2026-82654High 8.9SiYuan before v3.8.1 Stored XSS via block name
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82653High 8.9SiYuan before v3.8.1 Stored XSS via confirmDialog
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82652Medium 5.3SiYuan before v3.8.1 Information Disclosure via Publish Access
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82651Medium 4.9SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82650Medium 4.4SiYuan before v3.8.1 Path Traversal via /api/template/render
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82649High 7.0SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
Assigned by VulnCheck
Aug 30, 2026
CVE-2026-82234High 8.2SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
Assigned by VulnCheck
Aug 28, 2026
CVE-2026-82233Medium 5.7SiYuan before v3.8.1 Path Traversal via asset.upload
Assigned by VulnCheck
Aug 28, 2026
CVE-2026-62204Medium 6.6SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-60084High 8.7SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-60083Medium 4.9SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-59809Medium 4.9SiYuan before v3.8.0 Secret Exfiltration via http_request URL
Assigned by VulnCheck
Aug 22, 2026
CVE-2026-77086Critical 9.1SiYuan before v3.7.4 Path Traversal via packageName
Assigned by VulnCheck
Aug 21, 2026
CVE-2026-75917High 8.6SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
Assigned by VulnCheck
Aug 19, 2026
CVE-2026-75916High 8.6SiYuan XSS-to-RCE via unescaped block metadata in hint popup
Assigned by VulnCheck
Aug 19, 2026
CVE-2026-74906High 7.5SiYuan before v3.7.4 Incorrect Authorization via Publish Access
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74905High 7.1SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74904High 7.5SiYuan before v3.7.4 Missing Authorization via block API
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74903Medium 4.3SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74902High 8.6SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74868High 7.5SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74867Medium 4.2SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74802High 8.2SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74801High 8.2SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74800Critical 9.0SiYuan before v3.7.4 Stored XSS via assets endpoint
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74799Critical 9.3SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-74798High 8.7SiYuan kernel Path Traversal via database_clean MCP tool
Assigned by VulnCheck
Aug 17, 2026
CVE-2026-73056Critical 9.8SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
Assigned by VulnCheck
Aug 16, 2026
CVE-2026-73054High 7.5SiYuan before v3.7.4 Authentication Bypass via WebSocket
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73053Critical 9.0SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73052Critical 9.0SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73050Critical 9.0SiYuan before v3.7.4 Stored XSS via select option color
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73047Medium 6.2siyuan before v3.7.4 Server-Side Template Injection via attribute-view
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73046Critical 9.8SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73045High 7.5SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73044Critical 9.0SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73043Critical 9.0SiYuan before v3.7.4 Remote Code Execution via Template Calculation
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73042Critical 9.0SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73041Critical 9.0SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
Assigned by VulnCheck
Aug 15, 2026
CVE-2026-73630Medium 5.8SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-73049Medium 5.8SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-73048Medium 5.8SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-72812Medium 6.5SiYuan before v3.7.4 Missing Authorization via refreshBacklink
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-72811Critical 10.0SiYuan before v3.7.4 SQL Injection via backlink search
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-72810High 8.6SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
Assigned by VulnCheck
Aug 14, 2026
CVE-2026-73610Medium 5.8SiYuan before v3.7.4 Information Disclosure via Local Storage
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-73609Medium 5.8SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-73608High 8.6SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-73607Medium 5.8SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
Assigned by VulnCheck
Aug 13, 2026
PreviousPage 2 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.