siyuan vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

SI

Product

siyuan

by siyuan-note · last CVE Oct 28, 2026

219

CVEs

0

On KEV

10.0

Max CVSS

13

New 30D

Vulnerabilities219 In the news0 Timeline

Severity mix

Critical 42High 92Medium 85Low 0

Severity

All severities219 Critical42 High92 Medium85 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add siyuan to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-116170 New	4.9	0%	Oct 25	SiYuan before v3.8.7 SQL Injection via History Search op and query Affected: before 3.8.7
CVE-2026-87808	4.9	0%	Sep 9	SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock Affected: before 3.8.2
CVE-2026-82651	4.9	0%	Aug 30	SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff Affected: before 3.8.1
CVE-2026-60083	4.9	0%	Aug 22	SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool Affected: before 3.8.0
CVE-2026-59809	4.9	0%	Aug 22	SiYuan before v3.8.0 Secret Exfiltration via http_request URL Affected: before 3.8.0
CVE-2026-59854	4.9	0%	Jul 9	SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace Affected: < 3.7.1
CVE-2026-32747	4.9	0%	Mar 19	SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets Affected: < 3.6.1
CVE-2026-100640	4.7	0%	Sep 26	SiYuan before v3.8.4 Clipboard Data Disclosure via IPC Affected: before 3.8.4
CVE-2026-100634	4.7	1%	Sep 26	SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows Affected: before 3.8.4
CVE-2026-118680 New	4.4	–	Oct 28	SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias Affected: 3.8.7 through 3.8.8
CVE-2026-116171 New	4.4	1%	Oct 25	SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix Affected: 3.5.4 before 3.8.7
CVE-2026-82650	4.4	0%	Aug 30	SiYuan before v3.8.1 Path Traversal via /api/template/render Affected: before 3.8.1
CVE-2026-93921	4.3	0%	Sep 18	SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint Affected: through 3.8.4
CVE-2026-86191	4.3	0%	Sep 5	SiYuan before v3.8.2 Private Attribute View Key Enumeration Affected: before 3.8.2
CVE-2026-85579	4.3	0%	Sep 4	SiYuan before v3.8.2 Information Disclosure via undoState Affected: before 3.8.2
CVE-2026-74903	4.3	0%	Aug 18	SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM Affected: before 3.7.4
CVE-2026-45147	4.3	0%	May 14	SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk Affected: < 3.7.0
CVE-2026-45148	4.3	0%	May 14	SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata Affected: < 3.7.0
CVE-2026-74867	4.2	0%	Aug 17	SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth Affected: before 3.7.4