Siyuan

This hub aggregates every CVE we track for Siyuan, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Siyuan.

• CVE-2026-100646SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header8.1Sep 26, 2026
• CVE-2026-100644SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath7.5Sep 26, 2026
• CVE-2026-100645SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban8.0Sep 26, 2026
• CVE-2026-100643SiYuan before v3.8.4 Stored XSS via Attribute View textarea8.0Sep 26, 2026
• CVE-2026-100642SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth7.6Sep 26, 2026
• CVE-2026-100641SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content8.0Sep 26, 2026
• CVE-2026-100640SiYuan before v3.8.4 Clipboard Data Disclosure via IPC4.7Sep 26, 2026
• CVE-2026-100639SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL8.8Sep 26, 2026
• CVE-2026-100637SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID7.6Sep 26, 2026
• CVE-2026-100638SiYuan before v3.8.4 Path Traversal via setNotebookIcon7.6Sep 26, 2026
• CVE-2026-100636SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder7.6Sep 26, 2026
• CVE-2026-100635SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie5.9Sep 26, 2026
• CVE-2026-100634SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows4.7Sep 26, 2026
• CVE-2026-100633SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations6.5Sep 26, 2026
• CVE-2026-93923SiYuan through 3.8.4 Stored XSS via Heading Style Attribute8.8Sep 18, 2026