{"schema_version":1,"title":"SiYuan vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 161 vulnerabilities in SiYuan: 9 in the last 7 days and 137 in the last 90 days, 32 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100646, was published on 26 September 2026.","url":"https://junglewise.ai/threats/technologies/siyuan","json_url":"https://junglewise.ai/threats/technologies/siyuan.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/siyuan","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":63,"all_time":161,"critical":32,"exploited":0,"last_7_days":9,"last_30_days":74,"last_90_days":137,"last_365_days":161},"latest":[{"cve":"CVE-2026-100646","cvss":8.1,"slug":"cve-2026-100646-siyuan-is-a-self-hosted-personal-knowledge-management-system-in","title":"SiYuan authentication bypass via missing Origin header","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.9+00:00","url":"https://junglewise.ai/threats/cve-2026-100646-siyuan-is-a-self-hosted-personal-knowledge-management-system-in"},{"cve":"CVE-2026-100645","cvss":8,"slug":"cve-2026-100645-siyuan-versions-3-7-0-before-3-8-4-contain-a-stored-cross-site","title":"SiYuan stored cross-site scripting in gallery and kanban renderers","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.743+00:00","url":"https://junglewise.ai/threats/cve-2026-100645-siyuan-versions-3-7-0-before-3-8-4-contain-a-stored-cross-site"},{"cve":"CVE-2026-100643","cvss":8,"slug":"cve-2026-100643-siyuan-versions-before-v3-8-4-fail-to-properly-escape-four","title":"SiYuan stored XSS in Attribute View textarea elements","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.427+00:00","url":"https://junglewise.ai/threats/cve-2026-100643-siyuan-versions-before-v3-8-4-fail-to-properly-escape-four"},{"cve":"CVE-2026-100642","cvss":7.6,"slug":"cve-2026-100642-siyuan-versions-from-v2-1-0-before-v3-8-4-contain-a-cross-site","title":"SiYuan cross-site request forgery in CheckAuth lock-screen bypass","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.247+00:00","url":"https://junglewise.ai/threats/cve-2026-100642-siyuan-versions-from-v2-1-0-before-v3-8-4-contain-a-cross-site"},{"cve":"CVE-2026-100641","cvss":8,"slug":"cve-2026-100641-siyuan-before-v3-8-4-does-not-html-escape-stored-flashcard-block","title":"SiYuan stored XSS in flashcard content before v3.8.4","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:46.08+00:00","url":"https://junglewise.ai/threats/cve-2026-100641-siyuan-before-v3-8-4-does-not-html-escape-stored-flashcard-block"},{"cve":"CVE-2026-100636","cvss":7.6,"slug":"cve-2026-100636-siyuan-versions-before-v3-8-4-contain-a-path-traversal","title":"SiYuan path traversal in exportBrowserHTML","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:45.16+00:00","url":"https://junglewise.ai/threats/cve-2026-100636-siyuan-versions-before-v3-8-4-contain-a-path-traversal"},{"cve":"CVE-2026-100635","cvss":5.9,"slug":"cve-2026-100635-siyuan-before-v3-8-4-contains-an-authentication-bypass","title":"SiYuan authentication bypass in publish service","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:45.007+00:00","url":"https://junglewise.ai/threats/cve-2026-100635-siyuan-before-v3-8-4-contains-an-authentication-bypass"},{"cve":"CVE-2026-100634","cvss":4.7,"slug":"cve-2026-100634-siyuan-before-v3-8-4-does-not-validate-the-sender-or-restrict","title":"SiYuan IPC handler lacks sender validation in siyuan-send-windows","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:44.843+00:00","url":"https://junglewise.ai/threats/cve-2026-100634-siyuan-before-v3-8-4-does-not-validate-the-sender-or-restrict"},{"cve":"CVE-2026-100633","cvss":6.5,"slug":"cve-2026-100633-siyuan-is-a-self-hosted-personal-knowledge-management-system-in","title":"SiYuan sensitive-path guard bypass in recursive MCP file operations","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:44.687+00:00","url":"https://junglewise.ai/threats/cve-2026-100633-siyuan-is-a-self-hosted-personal-knowledge-management-system-in"},{"cve":"CVE-2026-93923","cvss":8.8,"epss":0.006,"slug":"cve-2026-93923-siyuan-through-3-8-4-fails-to-escape-heading-style-attributes","title":"SiYuan stored cross-site scripting in outline and bookmark rendering","severity":"high","exploited":false,"published_at":"2026-09-19T00:16:57.963+00:00","url":"https://junglewise.ai/threats/cve-2026-93923-siyuan-through-3-8-4-fails-to-escape-heading-style-attributes"},{"cve":"CVE-2026-93591","cvss":7.6,"epss":0.0032,"slug":"cve-2026-93591-siyuan-sql-injection-in-graph-query-via-unescaped-tag","title":"SiYuan SQL injection in graph query via unescaped tag","severity":"high","exploited":false,"published_at":"2026-09-18T14:19:10.097+00:00","url":"https://junglewise.ai/threats/cve-2026-93591-siyuan-sql-injection-in-graph-query-via-unescaped-tag"},{"cve":"CVE-2026-92986","cvss":8.8,"epss":0.0082,"slug":"cve-2026-92986-siyuan-unescaped-html-rendering-in-backlink-dock-tree","title":"SiYuan unescaped HTML rendering in backlink dock tree","severity":"high","exploited":false,"published_at":"2026-09-17T15:17:02.033+00:00","url":"https://junglewise.ai/threats/cve-2026-92986-siyuan-unescaped-html-rendering-in-backlink-dock-tree"},{"cve":"CVE-2026-92985","cvss":8.8,"epss":0.0082,"slug":"cve-2026-92985-siyuan-cross-site-scripting-in-bookmark-rendering","title":"SiYuan cross-site scripting in bookmark rendering","severity":"high","exploited":false,"published_at":"2026-09-17T15:17:01.84+00:00","url":"https://junglewise.ai/threats/cve-2026-92985-siyuan-cross-site-scripting-in-bookmark-rendering"},{"cve":"CVE-2026-87815","cvss":8.7,"epss":0.0048,"slug":"cve-2026-87815-siyuan-path-traversal-in-removeriffdeck-endpoint","title":"SiYuan path traversal in removeRiffDeck endpoint","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:16.537+00:00","url":"https://junglewise.ai/threats/cve-2026-87815-siyuan-path-traversal-in-removeriffdeck-endpoint"},{"cve":"CVE-2026-87814","cvss":7.3,"epss":0.0037,"slug":"cve-2026-87814-siyuan-stored-xss-in-search-asset-preview","title":"SiYuan stored XSS in search asset preview","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:16.39+00:00","url":"https://junglewise.ai/threats/cve-2026-87814-siyuan-stored-xss-in-search-asset-preview"},{"cve":"CVE-2026-87813","cvss":7.3,"epss":0.0037,"slug":"cve-2026-87813-siyuan-stored-xss-in-search-assets-via-unescaped-filenames","title":"SiYuan stored XSS in Search Assets via unescaped filenames","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:16.25+00:00","url":"https://junglewise.ai/threats/cve-2026-87813-siyuan-stored-xss-in-search-assets-via-unescaped-filenames"},{"cve":"CVE-2026-87812","cvss":6.8,"epss":0.0036,"slug":"cve-2026-87812-siyuan-stored-cross-site-scripting-in-bazaar-package-cards","title":"SiYuan stored cross-site scripting in Bazaar package cards","severity":"medium","exploited":false,"published_at":"2026-09-09T12:17:16.1+00:00","url":"https://junglewise.ai/threats/cve-2026-87812-siyuan-stored-cross-site-scripting-in-bazaar-package-cards"},{"cve":"CVE-2026-87811","cvss":7.3,"epss":0.0037,"slug":"cve-2026-87811-siyuan-stored-xss-in-notebook-template-paths","title":"SiYuan stored XSS in notebook template paths","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:15.95+00:00","url":"https://junglewise.ai/threats/cve-2026-87811-siyuan-stored-xss-in-notebook-template-paths"},{"cve":"CVE-2026-87810","cvss":5.3,"epss":0.0034,"slug":"cve-2026-87810-siyuan-information-disclosure-in-fulltextsearchblock-search","title":"Siyuan information disclosure in fullTextSearchBlock search endpoint","severity":"medium","exploited":false,"published_at":"2026-09-09T12:17:15.797+00:00","url":"https://junglewise.ai/threats/cve-2026-87810-siyuan-information-disclosure-in-fulltextsearchblock-search"},{"cve":"CVE-2026-87809","cvss":6.5,"epss":0.0035,"slug":"cve-2026-87809-siyuan-information-disclosure-in-export-preview-and","title":"Siyuan information disclosure in export preview and copyStdMarkdown","severity":"medium","exploited":false,"published_at":"2026-09-09T12:17:15.65+00:00","url":"https://junglewise.ai/threats/cve-2026-87809-siyuan-information-disclosure-in-export-preview-and"},{"cve":"CVE-2026-87808","cvss":4.9,"epss":0.0044,"slug":"cve-2026-87808-siyuan-read-only-boundary-bypass-in-fulltextsearchblock-sql-mode","title":"SiYuan read-only boundary bypass in fullTextSearchBlock SQL mode","severity":"medium","exploited":false,"published_at":"2026-09-09T12:17:15.503+00:00","url":"https://junglewise.ai/threats/cve-2026-87808-siyuan-read-only-boundary-bypass-in-fulltextsearchblock-sql-mode"},{"cve":"CVE-2026-87807","cvss":7.5,"epss":0.0045,"slug":"cve-2026-87807-siyuan-authenticated-sql-injection-in-fulltextsearchblock","title":"SiYuan authenticated SQL injection in fullTextSearchBlock","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:15.343+00:00","url":"https://junglewise.ai/threats/cve-2026-87807-siyuan-authenticated-sql-injection-in-fulltextsearchblock"},{"cve":"CVE-2026-72789","cvss":8.6,"epss":0.005,"slug":"cve-2026-72789-siyuan-publish-access-gate-treats-encrypted-notebooks-as-public","title":"SiYuan publish-access gate treats encrypted notebooks as public by default","severity":"high","exploited":false,"published_at":"2026-09-08T17:56:07+00:00","url":"https://junglewise.ai/threats/cve-2026-72789-siyuan-publish-access-gate-treats-encrypted-notebooks-as-public"},{"cve":"CVE-2026-72790","cvss":5.8,"epss":0.0033,"slug":"cve-2026-72790-siyuan-getnotebookinfo-unauthorized-disclosure-in-api","title":"SiYuan getNotebookInfo unauthorized disclosure in API","severity":"medium","exploited":false,"published_at":"2026-09-08T17:54:19+00:00","url":"https://junglewise.ai/threats/cve-2026-72790-siyuan-getnotebookinfo-unauthorized-disclosure-in-api"},{"cvss":5.8,"slug":"siyuan-getattributeviewfieldviews-missing-authorization-cb8fd4f6","title":"SiYuan getAttributeViewFieldViews missing authorization","severity":"medium","exploited":false,"published_at":"2026-09-08T17:53:44+00:00","url":"https://junglewise.ai/threats/siyuan-getattributeviewfieldviews-missing-authorization-cb8fd4f6"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":3,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":1,"exploited":0,"vulnerabilities":3},{"week":"2026-08-03","critical":2,"exploited":0,"vulnerabilities":8},{"week":"2026-08-10","critical":7,"exploited":0,"vulnerabilities":37},{"week":"2026-08-17","critical":1,"exploited":0,"vulnerabilities":5},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-08-31","critical":4,"exploited":0,"vulnerabilities":40},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":9}],"related":[],"technology":{"hub":true,"name":"SiYuan","slug":"siyuan","vendor":{"name":"SiYuan","slug":"siyuan","url":"https://junglewise.ai/threats/vendors/siyuan"},"aliases":[],"category":"web-application","url":"https://junglewise.ai/threats/technologies/siyuan"},"most_severe":[{"cve":"CVE-2026-69084","cvss":10,"epss":0.0157,"slug":"cve-2026-69084-siyuan-arbitrary-sql-execution-via-searchembedblock","title":"SiYuan arbitrary SQL execution via searchEmbedBlock","severity":"critical","exploited":false,"published_at":"2026-09-03T20:19:22+00:00","url":"https://junglewise.ai/threats/cve-2026-69084-siyuan-arbitrary-sql-execution-via-searchembedblock"},{"cve":"CVE-2026-69083","cvss":10,"epss":0.0048,"slug":"cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp","title":"SiYuan fullTextSearchAssetContent SQL injection and REGEXP breakout","severity":"critical","exploited":false,"published_at":"2026-09-03T21:01:05+00:00","url":"https://junglewise.ai/threats/cve-2026-69083-siyuan-fulltextsearchassetcontent-sql-injection-and-regexp"},{"cve":"CVE-2026-72811","cvss":10,"epss":0.0044,"slug":"cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata","title":"SiYuan backlink search SQL injection via unescaped metadata concatenation","severity":"critical","exploited":false,"published_at":"2026-09-03T22:27:50+00:00","url":"https://junglewise.ai/threats/cve-2026-72811-siyuan-backlink-search-sql-injection-via-unescaped-metadata"},{"cvss":10,"slug":"siyuan-sql-injection-in-backlink-mention-search-9ca0d701","title":"SiYuan SQL injection in backlink/mention search","severity":"critical","exploited":false,"published_at":"2026-08-14T12:31:24+00:00","url":"https://junglewise.ai/threats/siyuan-sql-injection-in-backlink-mention-search-9ca0d701"},{"cvss":10,"slug":"siyuan-searchembedblock-sql-injection-1301810a","title":"SiYuan searchEmbedBlock SQL injection","severity":"critical","exploited":false,"published_at":"2026-08-03T15:32:48+00:00","url":"https://junglewise.ai/threats/siyuan-searchembedblock-sql-injection-1301810a"},{"cvss":10,"slug":"siyuan-sql-injection-in-fulltextsearchassetcontent-endpoint-77bd29ce","title":"SiYuan SQL injection in fullTextSearchAssetContent endpoint","severity":"critical","exploited":false,"published_at":"2026-08-03T15:32:48+00:00","url":"https://junglewise.ai/threats/siyuan-sql-injection-in-fulltextsearchassetcontent-endpoint-77bd29ce"},{"cve":"CVE-2026-66012","cvss":10,"slug":"cve-2026-66012-siyuan-missing-authorization-in-mcp-kernel-endpoint","title":"SiYuan missing authorization in MCP kernel endpoint","severity":"critical","exploited":false,"published_at":"2026-07-25T11:17:19.053+00:00","url":"https://junglewise.ai/threats/cve-2026-66012-siyuan-missing-authorization-in-mcp-kernel-endpoint"},{"cve":"CVE-2026-50551","cvss":9.9,"epss":0.0078,"slug":"cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer","title":"SiYuan stored XSS to RCE in Attribute View asset cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:47.513+00:00","url":"https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer"},{"cve":"CVE-2026-54067","cvss":9.9,"epss":0.0054,"slug":"cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout","title":"SiYuan stored XSS to RCE via CSS snippet breakout","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.177+00:00","url":"https://junglewise.ai/threats/cve-2026-54067-siyuan-stored-xss-to-rce-via-css-snippet-breakout"},{"cve":"CVE-2026-54158","cvss":9.9,"epss":0.0051,"slug":"cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer","title":"SiYuan Stored XSS to RCE in attribute-view cell renderer","severity":"critical","exploited":false,"published_at":"2026-06-24T22:16:48.74+00:00","url":"https://junglewise.ai/threats/cve-2026-54158-siyuan-stored-xss-to-rce-in-attribute-view-cell-renderer"}],"generated_at":"2026-09-26T16:07:00.132667+00:00"}