Known Vulnerabilities for Siyuan by Siyuan-note
Listed below are 10 of the newest known vulnerabilities associated with "Siyuan" by "Siyuan-note".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-66396 json | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover im... | Not Provided | 2026-07-27 | 2026-07-28 |
| CVE-2026-66395 json | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that... | Not Provided | 2026-07-27 | 2026-07-28 |
| CVE-2026-66394 json | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authe... | Not Provided | 2026-07-27 | 2026-07-28 |
| CVE-2026-66012 json | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by ... | Not Provided | 2026-07-25 | 2026-07-28 |
| CVE-2026-65607 json | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport han... | Not Provided | 2026-07-23 | 2026-07-27 |
| CVE-2026-65606 json | SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins... | Not Provided | 2026-07-23 | 2026-07-23 |
| CVE-2026-65605 json | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Temp... | Not Provided | 2026-07-23 | 2026-07-23 |
| CVE-2026-59855 json | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpo... | Not Provided | 2026-07-09 | 2026-07-14 |
| CVE-2026-59854 json | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacke... | Not Provided | 2026-07-09 | 2026-07-10 |
| CVE-2026-59853 json | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns ... | Not Provided | 2026-07-09 | 2026-07-10 |