Approved changes feed: RSS · Atom
cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | B3Log (86d16015-6676-51cc-958c-521884a67196) |
|---|---|
| Product | Siyuan (173c2db0-bf9a-50e3-b833-47ab1492d21c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/siyuan-note/siyuan |
purl2cpe | 2026-06-01 10:11:23.522824 |
pkg:github/siyuan-note/siyuan |
purl2cpe | 2026-06-01 10:11:23.522826 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-118680 |
vulnerable | 2026-11-03 10:17:04.589469 |
SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
MEDIUM (4.4)
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
Published: 2026-10-28T18:59:51.831Z
Updated: 2026-11-02T20:34:09.551Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-100640 |
vulnerable | 2026-11-03 10:15:33.304852 |
SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
MEDIUM (4.7)
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations.
Published: 2026-09-26T13:23:13.287Z
Updated: 2026-10-27T01:30:30.357Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-100635 |
vulnerable | 2026-11-03 10:15:33.041135 |
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
MEDIUM (5.9)
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
Published: 2026-09-26T13:23:09.854Z
Updated: 2026-10-27T01:30:29.704Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116168 |
vulnerable | 2026-11-03 10:15:21.972963 |
SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
MEDIUM (6.2)
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
Published: 2026-10-25T13:20:11.054Z
Updated: 2026-11-04T16:06:56.082Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116170 |
vulnerable | 2026-11-03 10:15:21.954130 |
SiYuan before v3.8.7 SQL Injection via History Search op and query
MEDIUM (4.9)
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
Published: 2026-10-25T13:20:12.378Z
Updated: 2026-10-29T16:13:59.106Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116169 |
vulnerable | 2026-11-03 10:15:21.800575 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116171 |
vulnerable | 2026-11-03 10:15:21.769793 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116167 |
vulnerable | 2026-11-03 10:15:21.554014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116166 |
vulnerable | 2026-11-03 10:15:21.460571 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93591 |
vulnerable | 2026-10-13 12:28:56.096273 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93921 |
vulnerable | 2026-10-13 12:28:56.081263 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93923 |
vulnerable | 2026-10-13 12:28:55.976325 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93922 |
vulnerable | 2026-10-13 12:28:55.924456 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92985 |
vulnerable | 2026-10-13 12:28:53.712011 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92986 |
vulnerable | 2026-10-13 12:28:53.390617 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85583 |
vulnerable | 2026-09-16 04:33:08.238097 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85579 |
vulnerable | 2026-09-16 04:33:08.070594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85578 |
vulnerable | 2026-09-16 04:33:08.037997 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87811 |
vulnerable | 2026-09-16 04:33:01.598376 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87809 |
vulnerable | 2026-09-16 04:33:01.577275 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87815 |
vulnerable | 2026-09-16 04:33:01.573782 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87810 |
vulnerable | 2026-09-16 04:33:01.523561 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87808 |
vulnerable | 2026-09-16 04:33:01.507949 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87814 |
vulnerable | 2026-09-16 04:33:01.497533 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87812 |
vulnerable | 2026-09-16 04:33:01.255545 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87807 |
vulnerable | 2026-09-16 04:33:01.118218 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87813 |
vulnerable | 2026-09-16 04:33:01.077673 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86712 |
vulnerable | 2026-09-16 04:32:58.653866 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56397 |
vulnerable | 2026-07-29 01:00:29.143111 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56395 |
vulnerable | 2026-07-29 01:00:29.140773 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40922 |
vulnerable | 2026-06-08 08:01:21.136007 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40322 |
vulnerable | 2026-06-08 08:01:20.172466 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40318 |
vulnerable | 2026-06-08 08:01:20.167459 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40259 |
vulnerable | 2026-06-08 08:01:20.099249 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40107 |
vulnerable | 2026-06-08 08:01:19.907860 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39846 |
vulnerable | 2026-06-08 08:01:17.099130 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34605 |
vulnerable | 2026-06-08 07:59:12.748410 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34585 |
vulnerable | 2026-06-08 07:59:12.723665 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34453 |
vulnerable | 2026-06-08 07:59:12.518706 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34449 |
vulnerable | 2026-06-08 07:59:12.513100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34448 |
vulnerable | 2026-06-08 07:59:12.512769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33670 |
vulnerable | 2026-06-08 07:59:10.573603 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33669 |
vulnerable | 2026-06-08 07:59:10.564124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33476 |
vulnerable | 2026-06-08 07:59:10.148297 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33203 |
vulnerable | 2026-06-08 07:59:09.342167 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33194 |
vulnerable | 2026-06-08 07:59:09.329966 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33067 |
vulnerable | 2026-06-08 07:57:18.545465 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33066 |
vulnerable | 2026-06-08 07:57:18.545036 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32940 |
vulnerable | 2026-06-08 07:57:18.350138 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32938 |
vulnerable | 2026-06-08 07:57:18.349164 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32815 |
vulnerable | 2026-06-08 07:57:18.169987 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32767 |
vulnerable | 2026-06-08 07:57:18.135050 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32751 |
vulnerable | 2026-06-08 07:57:18.116192 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32750 |
vulnerable | 2026-06-08 07:57:18.115771 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32749 |
vulnerable | 2026-06-08 07:57:18.115326 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32747 |
vulnerable | 2026-06-08 07:57:18.113485 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32704 |
vulnerable | 2026-06-08 07:57:18.054414 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32110 |
vulnerable | 2026-06-08 07:57:16.684972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31809 |
vulnerable | 2026-06-08 07:57:15.916947 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31807 |
vulnerable | 2026-06-08 07:57:15.913361 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30926 |
vulnerable | 2026-06-08 07:57:14.552279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30869 |
vulnerable | 2026-06-08 07:57:14.404298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29183 |
vulnerable | 2026-06-08 07:55:16.198657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29073 |
vulnerable | 2026-06-08 07:55:16.077963 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25992 |
vulnerable | 2026-06-08 07:53:20.669071 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25539 |
vulnerable | 2026-06-08 07:53:19.968038 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23852 |
vulnerable | 2026-06-08 07:51:16.343937 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23851 |
vulnerable | 2026-06-08 07:51:16.343428 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23850 |
vulnerable | 2026-06-08 07:51:16.339026 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23847 |
vulnerable | 2026-06-08 07:51:16.336790 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23645 |
vulnerable | 2026-06-08 07:51:15.703843 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68948 |
vulnerable | 2026-06-08 07:41:21.967708 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67488 |
vulnerable | 2026-06-08 07:41:19.890236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.