CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product siyuan_note:siyuan. Show all products

134 CVEs, showing 1 to 50Page 1 of 3Next
CVESeverityTitlePublished
CVE-2026-109310Medium 6.5SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-109309Medium 6.5SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-105205Medium 5.3SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-104410High 7.5SiYuan before 3.8.5 Information Disclosure via /api/export/preview
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-103763Medium 5.8SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-103762Medium 5.3SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-101092Medium 5.3SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
Assigned by VulnCheck
Sep 28, 2026
CVE-2026-101091High 7.1SiYuan before v3.8.4 SQL Injection via Block Query Embed
Assigned by VulnCheck
Sep 28, 2026
CVE-2026-100646High 8.1SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100645High 8.0SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100644High 7.5SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100643High 8.0SiYuan before v3.8.4 Stored XSS via Attribute View textarea
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100642High 7.6SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100641High 8.0SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100640Medium 4.7SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100639High 8.8SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100638High 7.6SiYuan before v3.8.4 Path Traversal via setNotebookIcon
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100637High 7.6SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100636High 7.6SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100635Medium 5.9SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100634Medium 4.7SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100633Medium 6.5SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-93923High 8.8SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93922High 8.8SiYuan through 3.8.4 Stored XSS via notebook names
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93921Medium 4.3SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-93591High 7.6SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go
Assigned by VulnCheck
Sep 18, 2026
CVE-2026-92986High 8.8SiYuan before 3.8.4 Cross-Site Scripting via Document Title
Assigned by VulnCheck
Sep 17, 2026
CVE-2026-92985High 8.8SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
Assigned by VulnCheck
Sep 17, 2026
CVE-2026-87815High 8.7SiYuan before v3.8.2 Path Traversal via removeRiffDeck
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87814High 7.3SiYuan before v3.8.2 Stored XSS via Asset Preview
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87813High 7.3SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87812Medium 6.8SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87811High 7.3SiYuan before v3.8.2 Stored XSS via notebook template paths
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87810Medium 5.3Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87809Medium 6.5Siyuan before v3.8.2 Information Disclosure via Export Preview
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87808Medium 4.9SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-87807High 7.5siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86712High 8.8SiYuan before 3.8.2 Remote Code Execution via Clipboard
Assigned by VulnCheck
Sep 8, 2026
CVE-2026-86192Medium 6.5SiYuan before v3.8.2 Information Disclosure via Attribute-View
Assigned by VulnCheck
Sep 5, 2026
CVE-2026-86191Medium 4.3SiYuan before v3.8.2 Private Attribute View Key Enumeration
Assigned by VulnCheck
Sep 5, 2026
CVE-2026-85585High 7.5SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85584High 7.5SiYuan before v3.8.2 Denial of Service via Auth Throttle
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85583Medium 6.5SiYuan before v3.8.2 Path Traversal via symlink in file API
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85582Medium 6.5SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85581High 7.5SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85580Medium 6.5SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85579Medium 4.3SiYuan before v3.8.2 Information Disclosure via undoState
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85578Medium 6.5SiYuan through 3.8.1 Authorization Bypass via getFile
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85175High 8.8SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-85174High 8.8SiYuan before v3.8.2 API Token Exposure via Log File
Assigned by VulnCheck
Sep 3, 2026
Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.