Siyuan

This hub aggregates every CVE we track for Siyuan, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Siyuan.

• CVE-2026-93923SiYuan through 3.8.4 Stored XSS via Heading Style Attribute8.8Sep 18, 2026
• CVE-2026-93922SiYuan through 3.8.4 Stored XSS via notebook names8.8Sep 18, 2026
• CVE-2026-93921SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint4.3Sep 18, 2026
• CVE-2026-93591SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go7.6Sep 18, 2026
• CVE-2026-92986SiYuan before 3.8.4 Cross-Site Scripting via Document Title8.8Sep 17, 2026
• CVE-2026-92985SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels8.8Sep 17, 2026
• CVE-2026-87815SiYuan before v3.8.2 Path Traversal via removeRiffDeck8.7Sep 9, 2026
• CVE-2026-87814SiYuan before v3.8.2 Stored XSS via Asset Preview7.3Sep 9, 2026
• CVE-2026-87813SiYuan before v3.8.2 Stored XSS via unescaped asset filenames7.3Sep 9, 2026
• CVE-2026-87812SiYuan before v3.8.2 Stored XSS via Bazaar iconURL6.8Sep 9, 2026
• CVE-2026-87811SiYuan before v3.8.2 Stored XSS via notebook template paths7.3Sep 9, 2026
• CVE-2026-87810Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock5.3Sep 9, 2026
• CVE-2026-87809Siyuan before v3.8.2 Information Disclosure via Export Preview6.5Sep 9, 2026
• CVE-2026-87808SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock4.9Sep 9, 2026
• CVE-2026-87807siyuan before v3.8.2 SQL Injection via fullTextSearchBlock7.5Sep 9, 2026