Known Vulnerabilities for SiYuan by SiYuan
Listed below are 10 of the newest known vulnerabilities associated with "SiYuan" by "SiYuan".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-85175 json | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/... | Not Provided | 2026-09-03 | 2026-09-03 |
| CVE-2026-85174 json | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search reque... | Not Provided | 2026-09-03 | 2026-09-03 |
| CVE-2026-84803 json | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blo... | Not Provided | 2026-09-02 | 2026-09-02 |
| CVE-2026-82654 json | SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering ... | Not Provided | 2026-08-30 | 2026-09-01 |
| CVE-2026-82653 json | SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names an... | Not Provided | 2026-08-30 | 2026-09-02 |
| CVE-2026-82652 json | SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view ba... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-82651 json | SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path an... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-82650 json | SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/t... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-82649 json | SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vuln... | Not Provided | 2026-08-30 | 2026-09-01 |
| CVE-2026-82234 json | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent too... | Not Provided | 2026-08-28 | 2026-08-28 |