{"schema_version":1,"title":"SiYuan Note SiYuan vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 39 vulnerabilities in SiYuan Note SiYuan: 5 in the last 7 days and 21 in the last 90 days, 11 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100644, was published on 26 September 2026.","url":"https://junglewise.ai/threats/technologies/siyuan-note-siyuan","json_url":"https://junglewise.ai/threats/technologies/siyuan-note-siyuan.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/siyuan-note-siyuan","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":19,"all_time":39,"critical":11,"exploited":0,"last_7_days":5,"last_30_days":18,"last_90_days":21,"last_365_days":39},"latest":[{"cve":"CVE-2026-100644","cvss":7.5,"slug":"cve-2026-100644-siyuan-before-v3-8-4-contains-a-sql-injection-vulnerability-in","title":"SiYuan SQL injection in graph query endpoint","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.583+00:00","url":"https://junglewise.ai/threats/cve-2026-100644-siyuan-before-v3-8-4-contains-a-sql-injection-vulnerability-in"},{"cve":"CVE-2026-100640","cvss":4.7,"slug":"cve-2026-100640-siyuan-before-v3-8-4-contains-an-authorization-omission-in-the","title":"SiYuan authorization omission in siyuan-get IPC handler","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:45.82+00:00","url":"https://junglewise.ai/threats/cve-2026-100640-siyuan-before-v3-8-4-contains-an-authorization-omission-in-the"},{"cve":"CVE-2026-100639","cvss":8.8,"slug":"cve-2026-100639-siyuan-v3-8-3-fails-to-html-escape-the-data-subtype-attribute","title":"SiYuan gutter attribute injection and remote code execution","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.633+00:00","url":"https://junglewise.ai/threats/cve-2026-100639-siyuan-v3-8-3-fails-to-html-escape-the-data-subtype-attribute"},{"cve":"CVE-2026-100638","cvss":7.6,"slug":"cve-2026-100638-siyuan-versions-before-v3-8-4-contain-a-path-traversal","title":"SiYuan path traversal in setNotebookIcon","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.48+00:00","url":"https://junglewise.ai/threats/cve-2026-100638-siyuan-versions-before-v3-8-4-contain-a-path-traversal"},{"cve":"CVE-2026-100637","cvss":7.6,"slug":"cve-2026-100637-siyuan-versions-before-v3-8-4-contain-a-path-traversal","title":"SiYuan path traversal in checkoutRepo endpoint","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.32+00:00","url":"https://junglewise.ai/threats/cve-2026-100637-siyuan-versions-before-v3-8-4-contain-a-path-traversal"},{"cve":"CVE-2026-93922","cvss":8.8,"epss":0.0082,"slug":"cve-2026-93922-siyuan-through-3-8-4-renders-notebook-names-as-raw-html-in-the","title":"SiYuan stored cross-site scripting in Daily Note picker","severity":"high","exploited":false,"published_at":"2026-09-19T00:16:57.783+00:00","url":"https://junglewise.ai/threats/cve-2026-93922-siyuan-through-3-8-4-renders-notebook-names-as-raw-html-in-the"},{"cve":"CVE-2026-93921","cvss":4.3,"epss":0.0038,"slug":"cve-2026-93921-siyuan-versions-through-3-8-4-fail-to-enforce-publish-access","title":"SiYuan access control bypass in getDynamicIcon endpoint","severity":"medium","exploited":false,"published_at":"2026-09-19T00:16:57.553+00:00","url":"https://junglewise.ai/threats/cve-2026-93921-siyuan-versions-through-3-8-4-fail-to-enforce-publish-access"},{"slug":"go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2","title":"SiYuan database view metadata disclosure via API endpoint","severity":"info","exploited":false,"published_at":"2026-09-10T14:48:42+00:00","url":"https://junglewise.ai/threats/go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2"},{"cve":"CVE-2026-72795","cvss":8.6,"epss":0.0041,"slug":"cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access","title":"SiYuan embedded block content leak via missing publish-access filtering","severity":"high","exploited":false,"published_at":"2026-09-04T21:13:13+00:00","url":"https://junglewise.ai/threats/cve-2026-72795-siyuan-embedded-block-content-leak-via-missing-publish-access"},{"cve":"CVE-2026-72794","cvss":8.6,"epss":0.0042,"slug":"cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system","title":"SiYuan session-cookie signing key disclosure in /api/system/getConf","severity":"high","exploited":false,"published_at":"2026-09-04T21:12:26+00:00","url":"https://junglewise.ai/threats/cve-2026-72794-siyuan-session-cookie-signing-key-disclosure-in-api-system"},{"cve":"CVE-2026-72796","cvss":5.8,"epss":0.0035,"slug":"cve-2026-72796-siyuan-static-routes-access-control-bypass","title":"SiYuan static routes access control bypass","severity":"medium","exploited":false,"published_at":"2026-09-04T21:02:22+00:00","url":"https://junglewise.ai/threats/cve-2026-72796-siyuan-static-routes-access-control-bypass"},{"cve":"CVE-2026-72798","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related","title":"SiYuan renderAttributeView missing authorization in related-database content","severity":"high","exploited":false,"published_at":"2026-09-04T20:58:04+00:00","url":"https://junglewise.ai/threats/cve-2026-72798-siyuan-renderattributeview-missing-authorization-in-related"},{"cve":"CVE-2026-72803","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and","title":"SiYuan missing publish-access filter on getBlockAttrs and batchGetBlockAttrs","severity":"medium","exploited":false,"published_at":"2026-09-03T22:58:29+00:00","url":"https://junglewise.ai/threats/cve-2026-72803-siyuan-missing-publish-access-filter-on-getblockattrs-and"},{"cve":"CVE-2026-72804","cvss":8.6,"epss":0.0043,"slug":"cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection","title":"SiYuan graph endpoints bypass publish password protection","severity":"high","exploited":false,"published_at":"2026-09-03T22:52:58+00:00","url":"https://junglewise.ai/threats/cve-2026-72804-siyuan-graph-endpoints-bypass-publish-password-protection"},{"cve":"CVE-2026-72809","cvss":8,"epss":0.003,"slug":"cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated","title":"SiYuan kernel localhost-trust admin bypass on auth-gated endpoints","severity":"high","exploited":false,"published_at":"2026-09-03T22:34:06+00:00","url":"https://junglewise.ai/threats/cve-2026-72809-siyuan-kernel-localhost-trust-admin-bypass-on-auth-gated"},{"cve":"CVE-2026-72810","cvss":8.6,"epss":0.0054,"slug":"cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast","title":"SiYuan publish-boundary bypass via WebSocket broadcast","severity":"high","exploited":false,"published_at":"2026-09-03T22:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-72810-siyuan-publish-boundary-bypass-via-websocket-broadcast"},{"cve":"CVE-2026-68584","cvss":8.6,"epss":0.0054,"slug":"cve-2026-68584-siyuan-password-protected-document-bypass-via-content-api","title":"SiYuan password-protected document bypass via content API endpoints","severity":"high","exploited":false,"published_at":"2026-09-03T21:22:42+00:00","url":"https://junglewise.ai/threats/cve-2026-68584-siyuan-password-protected-document-bypass-via-content-api"},{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cve":"CVE-2026-66394","cvss":8.7,"epss":0.0047,"slug":"cve-2026-66394-siyuan-xss-via-svg-sanitizer-bypass","title":"SiYuan XSS via SVG sanitizer bypass","severity":"high","exploited":false,"published_at":"2026-07-27T16:18:11.947+00:00","url":"https://junglewise.ai/threats/cve-2026-66394-siyuan-xss-via-svg-sanitizer-bypass"},{"cve":"CVE-2026-65607","cvss":6.5,"epss":0.0059,"slug":"cve-2026-65607-siyuan-path-traversal-in-export-temp-handler","title":"SiYuan path traversal in export/temp handler","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:47.633+00:00","url":"https://junglewise.ai/threats/cve-2026-65607-siyuan-path-traversal-in-export-temp-handler"},{"cve":"CVE-2026-59832","cvss":7.7,"epss":0.0047,"slug":"cve-2026-59832-siyuan-path-traversal-in-servesnippets-route-handler","title":"SiYuan path traversal in serveSnippets route handler","severity":"high","exploited":false,"published_at":"2026-07-09T23:17:05.627+00:00","url":"https://junglewise.ai/threats/cve-2026-59832-siyuan-path-traversal-in-servesnippets-route-handler"},{"cve":"CVE-2026-54158","cvss":9.9,"epss":0.0051,"slug":"cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer","title":"SiYuan Stored XSS to RCE in attribute-view cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.74+00:00","url":"https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer"},{"cve":"CVE-2026-54070","cvss":7.1,"epss":0.003,"slug":"cve-2026-54070-siyuan-stored-xss-in-bazaar-marketplace-package-readme","title":"SiYuan stored XSS in Bazaar marketplace package README","severity":"high","exploited":false,"published_at":"2026-06-24T22:16:48.583+00:00","url":"https://junglewise.ai/threats/cve-2026-54070-siyuan-stored-xss-in-bazaar-marketplace-package-readme"},{"cve":"CVE-2026-54069","cvss":4,"epss":0.0058,"slug":"cve-2026-54069-siyuan-note-unauthenticated-admin-api-access-via-browser","title":"SiYuan Note unauthenticated admin API access via browser extensions","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.433+00:00","url":"https://junglewise.ai/threats/cve-2026-54069-siyuan-note-unauthenticated-admin-api-access-via-browser"},{"cve":"CVE-2026-54068","cvss":5.9,"epss":0.0038,"slug":"cve-2026-54068-siyuan-missing-authentication-and-sql-exfiltration-in","title":"SiYuan missing authentication and SQL exfiltration in getDynamicIcon API","severity":"medium","exploited":false,"published_at":"2026-06-24T22:16:48.303+00:00","url":"https://junglewise.ai/threats/cve-2026-54068-siyuan-missing-authentication-and-sql-exfiltration-in"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":1,"exploited":0,"vulnerabilities":10},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":5}],"related":[],"technology":{"hub":true,"name":"SiYuan Note SiYuan","slug":"siyuan-note-siyuan","vendor":{"name":"SiYuan Note","slug":"siyuan-note","url":"https://junglewise.ai/threats/vendors/siyuan-note"},"aliases":[],"category":"web","url":"https://junglewise.ai/threats/technologies/siyuan-note-siyuan"},"most_severe":[{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cve":"CVE-2026-50551","cvss":9.9,"epss":0.0078,"slug":"cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer","title":"SiYuan stored XSS to RCE in Attribute View asset cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:47.513+00:00","url":"https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer"},{"cve":"CVE-2026-54067","cvss":9.9,"epss":0.0054,"slug":"cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout","title":"SiYuan stored XSS to RCE via CSS snippet breakout","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.177+00:00","url":"https://junglewise.ai/threats/cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout"},{"cve":"CVE-2026-54158","cvss":9.9,"epss":0.0051,"slug":"cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer","title":"SiYuan Stored XSS to RCE in attribute-view cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.74+00:00","url":"https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer"},{"cve":"CVE-2026-34449","cvss":9.6,"epss":0.008,"slug":"cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection","title":"SiYuan RCE via permissive CORS policy and snippet injection","severity":"critical","exploited":false,"published_at":"2026-03-31T22:16:19.83+00:00","url":"https://junglewise.ai/threats/cve-2026-34449-siyuan-rce-via-permissive-cors-policy-and-snippet-injection"},{"cve":"CVE-2026-34448","cvss":9,"epss":0.0073,"slug":"cve-2026-34448-siyuan-stored-xss-and-rce-in-attribute-view-gallery-cover","title":"SiYuan stored XSS and RCE in Attribute View gallery cover rendering","severity":"critical","exploited":false,"published_at":"2026-03-31T22:16:19.657+00:00","url":"https://junglewise.ai/threats/cve-2026-34448-siyuan-stored-xss-and-rce-in-attribute-view-gallery-cover"},{"cve":"CVE-2026-39846","cvss":9,"epss":0.0065,"slug":"cve-2026-39846-siyuan-remote-code-execution-via-stored-xss-in-table-captions","title":"SiYuan remote code execution via stored XSS in table captions","severity":"critical","exploited":false,"published_at":"2026-04-07T22:16:23.597+00:00","url":"https://junglewise.ai/threats/cve-2026-39846-siyuan-remote-code-execution-via-stored-xss-in-table-captions"},{"cve":"CVE-2026-45375","cvss":9,"epss":0.0041,"slug":"cve-2026-45375-siyuan-bazaar-xss-and-remote-code-execution-via-package-metadata","title":"SiYuan Bazaar XSS and Remote Code Execution via Package Metadata","severity":"critical","exploited":false,"published_at":"2026-05-14T19:16:39.03+00:00","url":"https://junglewise.ai/threats/cve-2026-45375-siyuan-bazaar-xss-and-remote-code-execution-via-package-metadata"},{"cve":"CVE-2026-54069","cvss":4,"epss":0.0058,"slug":"cve-2026-54069-siyuan-note-unauthenticated-admin-api-access-via-browser","title":"SiYuan Note unauthenticated admin API access via browser extensions","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.433+00:00","url":"https://junglewise.ai/threats/cve-2026-54069-siyuan-note-unauthenticated-admin-api-access-via-browser"},{"cve":"CVE-2026-44670","cvss":4,"epss":0.0055,"slug":"cve-2026-44670-siyuan-stored-xss-to-rce-via-attribute-view-names","title":"SiYuan Stored XSS to RCE via Attribute View names","severity":"critical","exploited":false,"published_at":"2026-05-14T19:16:38.437+00:00","url":"https://junglewise.ai/threats/cve-2026-44670-siyuan-stored-xss-to-rce-via-attribute-view-names"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}