Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-126264 | SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile | < 3.8.9 | 8.3 | — | 2026-11-13 | |
| CVE-2026-126265 | SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie | ≥ 2.1.0 < 3.8.9 | 9.1 | — | 2026-11-13 | |
| CVE-2026-126266 | SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords | ≥ 3.6.0 < 3.8.9 | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126393 | SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding | < 3.8.10 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126776 | SiYuan 3.7.0 before 3.8.10 Path Traversal File Write via MCP web_fetch | ≥ 3.7.0 < 3.8.10 | 6.0 | — | 2026-11-12 | |
| CVE-2026-123492 | SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read | < 3.8.9 | 6.9 | — | 2026-11-07 | |
| CVE-2026-118680 | SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias | ≥ 3.8.7 ≤ 3.8.8 | 5.9 | — | 2026-10-29 | |
| CVE-2026-116171 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | ≥ 3.5.4 < 3.8.7 | 5.9 | — | 2026-10-25 | |
| CVE-2026-116170 | SiYuan before v3.8.7 SQL Injection via History Search op and query | < 3.8.7 | 6.9 | — | 2026-10-25 | |
| CVE-2026-116169 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | ≥ 2.10.0 < 3.8.7 | 5.1 | — | 2026-10-25 | |
| CVE-2026-116168 | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool | < 3.8.7 | 6.9 | — | 2026-10-25 | |
| CVE-2026-116167 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | ≥ 2.9.0 < 3.8.7 | 7.6 | — | 2026-10-25 | |
| CVE-2026-116166 | SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting | ≥ 3.6.0 < 3.8.7 | 7.6 | — | 2026-10-25 | |
| CVE-2026-109310 | SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template | ≥ 3.1.12 < 3.8.6 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109309 | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | ≥ 3.7.0 < 3.8.6 | 6.9 | — | 2026-10-13 | |
| CVE-2026-105205 | SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo | < 3.8.5 | 6.9 | — | 2026-10-04 | |
| CVE-2026-104410 | SiYuan before 3.8.5 Information Disclosure via /api/export/preview | < 3.8.5 | 8.7 | — | 2026-10-02 | |
| CVE-2026-103763 | SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo | < 3.8.5 | 6.9 | — | 2026-10-02 | |
| CVE-2026-103762 | SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints | < 3.8.5 | 6.9 | — | 2026-10-02 | |
| CVE-2026-101092 | SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages | < 3.8.4 | 6.9 | — | 2026-09-29 | |
| CVE-2026-101091 | SiYuan before v3.8.4 SQL Injection via Block Query Embed | < 3.8.4 | 7.1 | — | 2026-09-29 | |
| CVE-2026-100646 | SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header | < 3.8.4 | 8.6 | — | 2026-09-26 | |
| CVE-2026-100645 | SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban | ≥ 3.7.0 < 3.8.4 | 8.6 | — | 2026-09-26 | |
| CVE-2026-100644 | SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath | < 3.8.4 | 8.7 | — | 2026-09-26 | |
| CVE-2026-100643 | SiYuan before v3.8.4 Stored XSS via Attribute View textarea | ≥ 2.10.8 < 3.8.4 | 8.5 | — | 2026-09-26 | |
| CVE-2026-100642 | SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth | ≥ 2.1.0 < 3.8.4 | 7.2 | — | 2026-09-26 | |
| CVE-2026-100641 | SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content | < 3.8.4 | 8.6 | — | 2026-09-26 | |
| CVE-2026-100640 | SiYuan before v3.8.4 Clipboard Data Disclosure via IPC | < 3.8.4 | 8.6 | — | 2026-09-26 | |
| CVE-2026-100639 | SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL | < 3.8.4 | 8.6 | — | 2026-09-26 | |
| CVE-2026-100638 | SiYuan before v3.8.4 Path Traversal via setNotebookIcon | < 3.8.4 | 8.3 | — | 2026-09-26 | |
| CVE-2026-100637 | SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID | < 3.8.4 | 8.3 | — | 2026-09-26 | |
| CVE-2026-100636 | SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder | < 3.8.4 | 8.3 | — | 2026-09-26 | |
| CVE-2026-100634 | SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows | < 3.8.4 | 5.3 | — | 2026-09-26 | |
| CVE-2026-100635 | SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie | < 3.8.4 | 8.2 | — | 2026-09-26 | |
| CVE-2026-100633 | SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations | ≥ 3.8.0 < 3.8.4 | 8.5 | — | 2026-09-26 | |
| CVE-2026-93923 | SiYuan through 3.8.4 Stored XSS via Heading Style Attribute | ≤ 3.8.4 | 8.6 | — | 2026-09-19 | |
| CVE-2026-93922 | SiYuan through 3.8.4 Stored XSS via notebook names | ≤ 3.8.4 | 8.6 | — | 2026-09-19 | |
| CVE-2026-93921 | SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint | ≤ 3.8.4 | 5.3 | — | 2026-09-19 | |
| CVE-2026-93591 | SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go | < 3.8.3 | 7.2 | — | 2026-09-18 | |
| CVE-2026-92986 | SiYuan before 3.8.4 Cross-Site Scripting via Document Title | < 3.8.4 | 8.6 | — | 2026-09-17 | |
| CVE-2026-92985 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels | < 3.8.4 | 8.6 | — | 2026-09-17 | |
| CVE-2026-87815 | SiYuan before v3.8.2 Path Traversal via removeRiffDeck | < 3.8.2 | 8.4 | — | 2026-09-09 | |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | < 3.8.2 | 8.4 | — | 2026-09-09 | |
| CVE-2026-87813 | SiYuan before v3.8.2 Stored XSS via unescaped asset filenames | < 3.8.2 | 8.4 | — | 2026-09-09 | |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | < 3.8.2 | 7.4 | — | 2026-09-09 | |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | < 3.8.2 | 8.4 | — | 2026-09-09 | |
| CVE-2026-87809 | Siyuan before v3.8.2 Information Disclosure via Export Preview | < 3.8.2 | 7.1 | — | 2026-09-09 | |
| CVE-2026-87810 | Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock | < 3.8.2 | 6.9 | — | 2026-09-09 | |
| CVE-2026-87808 | SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock | < 3.8.2 | 8.7 | — | 2026-09-09 | |
| CVE-2026-87807 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock | < 3.8.2 | 8.7 | — | 2026-09-09 | |
| CVE-2026-86712 | SiYuan before 3.8.2 Remote Code Execution via Clipboard | < 3.8.2 | 8.6 | — | 2026-09-08 | |
| CVE-2026-86192 | SiYuan before v3.8.2 Information Disclosure via Attribute-View | < 3.8.2 | 7.1 | — | 2026-09-05 | |
| CVE-2026-86191 | SiYuan before v3.8.2 Private Attribute View Key Enumeration | < 3.8.2 | 5.3 | — | 2026-09-05 | |
| CVE-2026-85585 | SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency | < 3.8.2 | 8.7 | — | 2026-09-04 | |
| CVE-2026-85584 | SiYuan before v3.8.2 Denial of Service via Auth Throttle | < 3.8.2 | 8.7 | — | 2026-09-04 | |
| CVE-2026-85583 | SiYuan before v3.8.2 Path Traversal via symlink in file API | < 3.8.2 | 7.1 | — | 2026-09-04 | |
| CVE-2026-85582 | SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth | < 3.8.2 | 7.1 | — | 2026-09-04 | |
| CVE-2026-85581 | SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration | < 3.8.2 | 8.7 | — | 2026-09-04 | |
| CVE-2026-85580 | SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch | < 3.8.2 | 7.1 | — | 2026-09-04 | |
| CVE-2026-85579 | SiYuan before v3.8.2 Information Disclosure via undoState | < 3.8.2 | 5.3 | — | 2026-09-04 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).