Known Vulnerabilities for SiYuan by SiYuan
Listed below are 10 of the newest known vulnerabilities associated with "SiYuan" by "SiYuan".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-123492 json | SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated atta... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-118680 json | SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath deny... | Not Provided | 2026-10-28 | 2026-11-02 |
| CVE-2026-116171 json | SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extende... | Not Provided | 2026-10-25 | 2026-10-28 |
| CVE-2026-116170 json | SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting ... | Not Provided | 2026-10-25 | 2026-10-29 |
| CVE-2026-116169 json | SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission t... | Not Provided | 2026-10-25 | 2026-10-29 |
| CVE-2026-116168 json | SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on ... | Not Provided | 2026-10-25 | 2026-11-04 |
| CVE-2026-116167 json | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that ass... | Not Provided | 2026-10-25 | 2026-10-26 |
| CVE-2026-116166 json | SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps se... | Not Provided | 2026-10-25 | 2026-10-29 |
| CVE-2026-109310 json | SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parame... | Not Provided | 2026-10-12 | 2026-10-13 |
| CVE-2026-109309 json | SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, whi... | Not Provided | 2026-10-12 | 2026-10-13 |