CVE Tools
Track your stack

Siyuan-note

201 CVEs tracked since 2024. Since Dec 2024, none of them reached CISA KEV.

Siyuan-note CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Siyuan-note CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-1240
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-03280
2026-0480
2026-057 or fewer
2026-0690
2026-07130
2026-08810
2026-09450
2026-10130
2026-110

Products

The products that kept showing up in Siyuan-note's monthly top three, with their CVEs summed over those months.

  1. Siyuan2018 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Siyuan-note.

  1. CVE-2026-123492SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read4.9
  2. CVE-2026-118680SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias4.4
  3. CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix4.4
  4. CVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and query4.9
  5. CVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks5.4
  6. CVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool6.2
  7. CVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter6.8
  8. CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting6.8
  9. CVE-2026-109310SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template6.5
  10. CVE-2026-109309SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path6.5
  11. CVE-2026-105205SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo5.3
  12. CVE-2026-104410SiYuan before 3.8.5 Information Disclosure via /api/export/preview7.5
  13. CVE-2026-103763SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo5.8
  14. CVE-2026-103762SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints5.3
  15. CVE-2026-101092SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages5.3

The record

Peak rank
#12 in Aug 2026
Busiest month shown
Aug 2026, 81 CVEs
Months with a KEV entry
0 since Dec 2024
Monthly snapshots
8 since 2024
Siyuan-note's full record, month by month