CVE Tools
Track your stack

Siyuan

227 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Siyuan, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Siyuan CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Siyuan CVEs per month
MonthCVEs
2024-124
2025-011
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-122
2026-015
2026-023
2026-0328
2026-048
2026-057
2026-0610
2026-0713
2026-0881
2026-0945
2026-1013
2026-111

Severity

How the 227 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical5023%
  • High8338%
  • Medium8338%
  • Low10%

Latest CVEs

The 15 most recently published vulnerabilities affecting Siyuan.

  1. CVE-2026-123492SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read4.9
  2. CVE-2026-118680SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias4.4
  3. CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix4.4
  4. CVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and query4.9
  5. CVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks5.4
  6. CVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool6.2
  7. CVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter6.8
  8. CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting6.8
  9. CVE-2026-109310SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template6.5
  10. CVE-2026-109309SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path6.5
  11. CVE-2026-105205SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo5.3
  12. CVE-2026-104410SiYuan before 3.8.5 Information Disclosure via /api/export/preview7.5
  13. CVE-2026-103763SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo5.8
  14. CVE-2026-103762SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints5.3
  15. CVE-2026-101092SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages5.3

Product grouping is registry-driven, with AI assist and human review. How it works