{"schema_version":1,"title":"github.com/siyuan-note/siyuan/kernel (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 158 vulnerabilities in github.com/siyuan-note/siyuan/kernel (Go): 0 in the last 7 days and 95 in the last 90 days, 18 of them critical and 0 exploited in the wild. The most recent, SiYuan database view metadata disclosure via API endpoint, was published on 10 September 2026.","url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel","json_url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":39,"all_time":158,"critical":18,"exploited":0,"last_7_days":0,"last_30_days":35,"last_90_days":95,"last_365_days":153},"latest":[{"slug":"go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2","title":"SiYuan database view metadata disclosure via API endpoint","severity":"info","exploited":false,"published_at":"2026-09-10T14:48:42+00:00","url":"https://junglewise.ai/threats/go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2"},{"cve":"CVE-2026-72789","cvss":8.6,"epss":0.005,"slug":"cve-2026-72789-siyuan-publish-access-gate-treats-encrypted-notebooks-as-public","title":"SiYuan publish-access gate treats encrypted notebooks as public by default","severity":"high","exploited":false,"published_at":"2026-09-08T17:56:07+00:00","url":"https://junglewise.ai/threats/cve-2026-72789-siyuan-publish-access-gate-treats-encrypted-notebooks-as-public"},{"cve":"CVE-2026-72790","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72790-siyuan-getnotebookinfo-unauthorized-disclosure-in-api","title":"SiYuan getNotebookInfo unauthorized disclosure in API","severity":"medium","exploited":false,"published_at":"2026-09-08T17:54:19+00:00","url":"https://junglewise.ai/threats/cve-2026-72790-siyuan-getnotebookinfo-unauthorized-disclosure-in-api"},{"cvss":3.1,"slug":"siyuan-database-view-structure-all-view-names-layout-types-and-per-88260932","title":"SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttri","severity":"low","exploited":false,"published_at":"2026-09-08T17:53:44+00:00","url":"https://junglewise.ai/threats/siyuan-database-view-structure-all-view-names-layout-types-and-per-88260932"},{"cvss":5.8,"slug":"siyuan-getattributeviewfieldviews-missing-authorization-cb8fd4f6","title":"SiYuan getAttributeViewFieldViews missing authorization","severity":"medium","exploited":false,"published_at":"2026-09-08T17:53:44+00:00","url":"https://junglewise.ai/threats/siyuan-getattributeviewfieldviews-missing-authorization-cb8fd4f6"},{"cve":"CVE-2026-72792","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72792-siyuan-tag-api-information-disclosure-via-password-bypass","title":"SiYuan tag API information disclosure via password bypass","severity":"medium","exploited":false,"published_at":"2026-09-04T21:24:19+00:00","url":"https://junglewise.ai/threats/cve-2026-72792-siyuan-tag-api-information-disclosure-via-password-bypass"},{"cve":"CVE-2026-72793","cvss":8.6,"epss":0.0041,"slug":"cve-2026-72793-siyuan-getconf-information-disclosure-of-session-key-and-secrets","title":"SiYuan getConf information disclosure of session key and secrets","severity":"high","exploited":false,"published_at":"2026-09-04T21:16:48+00:00","url":"https://junglewise.ai/threats/cve-2026-72793-siyuan-getconf-information-disclosure-of-session-key-and-secrets"},{"cve":"CVE-2026-72795","cvss":8.6,"epss":0.0041,"slug":"cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access","title":"SiYuan embedded block content leak via missing publish-access filtering","severity":"high","exploited":false,"published_at":"2026-09-04T21:13:13+00:00","url":"https://junglewise.ai/threats/cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access"},{"cve":"CVE-2026-72794","cvss":8.6,"epss":0.0042,"slug":"cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system","title":"SiYuan session-cookie signing key disclosure in /api/system/getConf","severity":"high","exploited":false,"published_at":"2026-09-04T21:12:26+00:00","url":"https://junglewise.ai/threats/cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system"},{"cve":"CVE-2026-72796","cvss":5.8,"epss":0.0035,"slug":"cve-2026-72796-siyuan-static-routes-access-control-bypass","title":"SiYuan static routes access control bypass","severity":"medium","exploited":false,"published_at":"2026-09-04T21:02:22+00:00","url":"https://junglewise.ai/threats/cve-2026-72796-siyuan-static-routes-access-control-bypass"},{"cve":"CVE-2026-72797","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72797-siyuan-getencryptednotebookstatus-information-disclosure","title":"SiYuan getEncryptedNotebookStatus information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-04T21:01:46+00:00","url":"https://junglewise.ai/threats/cve-2026-72797-siyuan-getencryptednotebookstatus-information-disclosure"},{"cve":"CVE-2026-72798","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related","title":"SiYuan renderAttributeView missing authorization in related-database content","severity":"high","exploited":false,"published_at":"2026-09-04T20:58:04+00:00","url":"https://junglewise.ai/threats/cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related"},{"cve":"CVE-2026-72799","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72799-siyuan-missing-publish-access-filter-on-path-resolution-endpoints","title":"SiYuan missing publish-access filter on path-resolution endpoints","severity":"medium","exploited":false,"published_at":"2026-09-04T20:53:34+00:00","url":"https://junglewise.ai/threats/cve-2026-72799-siyuan-missing-publish-access-filter-on-path-resolution-endpoints"},{"cve":"CVE-2026-72800","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72800-siyuan-missing-authorization-filters-on-api-endpoints-leaks","title":"SiYuan missing authorization filters on API endpoints leaks database schema and block IDs","severity":"medium","exploited":false,"published_at":"2026-09-03T23:04:13+00:00","url":"https://junglewise.ai/threats/cve-2026-72800-siyuan-missing-authorization-filters-on-api-endpoints-leaks"},{"cve":"CVE-2026-72801","cvss":7.5,"epss":0.0041,"slug":"cve-2026-72801-siyuan-encrypted-notebook-key-material-and-wrapped-keys","title":"SiYuan encrypted notebook key material and wrapped keys disclosure","severity":"high","exploited":false,"published_at":"2026-09-03T23:02:12+00:00","url":"https://junglewise.ai/threats/cve-2026-72801-siyuan-encrypted-notebook-key-material-and-wrapped-keys"},{"cve":"CVE-2026-72802","cvss":5.3,"epss":0.0033,"slug":"cve-2026-72802-siyuan-resolveassetpath-information-disclosure","title":"SiYuan resolveAssetPath information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-03T23:00:52+00:00","url":"https://junglewise.ai/threats/cve-2026-72802-siyuan-resolveassetpath-information-disclosure"},{"cve":"CVE-2026-72803","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and","title":"SiYuan missing publish-access filter on getBlockAttrs and batchGetBlockAttrs","severity":"medium","exploited":false,"published_at":"2026-09-03T22:58:29+00:00","url":"https://junglewise.ai/threats/cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and"},{"cve":"CVE-2026-72804","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection","title":"SiYuan graph endpoints bypass publish password protection","severity":"high","exploited":false,"published_at":"2026-09-03T22:52:58+00:00","url":"https://junglewise.ai/threats/cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection"},{"cve":"CVE-2026-72805","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72805-siyuan-missing-authorization-in-block-api-endpoints","title":"SiYuan missing authorization in block API endpoints","severity":"medium","exploited":false,"published_at":"2026-09-03T22:52:12+00:00","url":"https://junglewise.ai/threats/cve-2026-72805-siyuan-missing-authorization-in-block-api-endpoints"},{"cve":"CVE-2026-72806","cvss":5.8,"epss":0.0043,"slug":"cve-2026-72806-siyuan-attribute-view-database-password-bypass-in-publish-mode","title":"SiYuan attribute-view database password bypass in publish mode","severity":"medium","exploited":false,"published_at":"2026-09-03T22:50:49+00:00","url":"https://junglewise.ai/threats/cve-2026-72806-siyuan-attribute-view-database-password-bypass-in-publish-mode"},{"cve":"CVE-2026-72807","cvss":8,"epss":0.0033,"slug":"cve-2026-72807-siyuan-second-order-sql-injection-via-queryblocks-template","title":"SiYuan second-order SQL injection via queryBlocks template function","severity":"high","exploited":false,"published_at":"2026-09-03T22:49:30+00:00","url":"https://junglewise.ai/threats/cve-2026-72807-siyuan-second-order-sql-injection-via-queryblocks-template"},{"cve":"CVE-2026-72808","cvss":5.8,"epss":0.004,"slug":"cve-2026-72808-siyuan-missing-authorization-on-getfileannotation-endpoint","title":"SiYuan missing authorization on getFileAnnotation endpoint","severity":"medium","exploited":false,"published_at":"2026-09-03T22:48:22+00:00","url":"https://junglewise.ai/threats/cve-2026-72808-siyuan-missing-authorization-on-getfileannotation-endpoint"},{"cve":"CVE-2026-72809","cvss":8,"epss":0.003,"slug":"cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated","title":"SiYuan kernel localhost-trust admin bypass on auth-gated endpoints","severity":"high","exploited":false,"published_at":"2026-09-03T22:34:06+00:00","url":"https://junglewise.ai/threats/cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated"},{"cve":"CVE-2026-72810","cvss":8.6,"epss":0.0054,"slug":"cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast","title":"SiYuan publish-boundary bypass via WebSocket broadcast","severity":"high","exploited":false,"published_at":"2026-09-03T22:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast"},{"cve":"CVE-2026-72811","cvss":10,"epss":0.0044,"slug":"cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata","title":"SiYuan backlink search SQL injection via unescaped metadata concatenation","severity":"critical","exploited":false,"published_at":"2026-09-03T22:27:50+00:00","url":"https://junglewise.ai/threats/cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":1,"exploited":0,"vulnerabilities":10},{"week":"2026-08-10","critical":1,"exploited":0,"vulnerabilities":46},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":3,"exploited":0,"vulnerabilities":30},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":274,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":188,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":186,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":182,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":128,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik/v3 (Go)","slug":"github-com-traefik-traefik-v3","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3"},{"name":"github.com/hashicorp/vault (Go)","slug":"github-com-hashicorp-vault","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/github-com-hashicorp-vault"}],"technology":{"hub":true,"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://b3log.org/siyuan/","repo_url":"https://github.com/siyuan-note/siyuan","description":"The core kernel component of the SiYuan note-taking application, providing data management and synchronization logic.","url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},"most_severe":[{"cve":"CVE-2026-69084","cvss":10,"epss":0.0157,"slug":"cve-2026-69084-siyuan-arbitrary-sql-execution-via-searchembedblock","title":"SiYuan arbitrary SQL execution via searchEmbedBlock","severity":"critical","exploited":false,"published_at":"2026-09-03T20:19:22+00:00","url":"https://junglewise.ai/threats/cve-2026-69084-siyuan-arbitrary-sql-execution-via-searchembedblock"},{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cve":"CVE-2026-72811","cvss":10,"epss":0.0044,"slug":"cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata","title":"SiYuan backlink search SQL injection via unescaped metadata concatenation","severity":"critical","exploited":false,"published_at":"2026-09-03T22:27:50+00:00","url":"https://junglewise.ai/threats/cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata"},{"cvss":10,"slug":"siyuan-sql-injection-in-backlink-mention-search-9ca0d701","title":"SiYuan SQL injection in backlink/mention search","severity":"critical","exploited":false,"published_at":"2026-08-14T12:31:24+00:00","url":"https://junglewise.ai/threats/siyuan-sql-injection-in-backlink-mention-search-9ca0d701"},{"cvss":10,"slug":"siyuan-searchembedblock-sql-injection-1301810a","title":"SiYuan searchEmbedBlock SQL injection","severity":"critical","exploited":false,"published_at":"2026-08-03T15:32:48+00:00","url":"https://junglewise.ai/threats/siyuan-searchembedblock-sql-injection-1301810a"},{"cve":"CVE-2026-50551","cvss":9.9,"epss":0.0078,"slug":"cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer","title":"SiYuan stored XSS to RCE in Attribute View asset cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:47.513+00:00","url":"https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer"},{"cve":"CVE-2026-54067","cvss":9.9,"epss":0.0054,"slug":"cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout","title":"SiYuan stored XSS to RCE via CSS snippet breakout","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.177+00:00","url":"https://junglewise.ai/threats/cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout"},{"cve":"CVE-2026-54158","cvss":9.9,"epss":0.0051,"slug":"cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer","title":"SiYuan Stored XSS to RCE in attribute-view cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.74+00:00","url":"https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer"},{"cve":"CVE-2026-34449","cvss":9.6,"epss":0.008,"slug":"cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection","title":"SiYuan RCE via permissive CORS policy and snippet injection","severity":"critical","exploited":false,"published_at":"2026-03-31T22:16:19.83+00:00","url":"https://junglewise.ai/threats/cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection"},{"cve":"CVE-2026-56397","cvss":9.6,"epss":0.007,"slug":"cve-2026-56397-siyuan-rce-via-unsanitized-bazaar-marketplace-metadata-and-readme","title":"SiYuan RCE via unsanitized Bazaar marketplace metadata and README","severity":"critical","exploited":false,"published_at":"2026-06-21T14:16:26.783+00:00","url":"https://junglewise.ai/threats/cve-2026-56397-siyuan-rce-via-unsanitized-bazaar-marketplace-metadata-and-readme"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}