siyuan
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/27/2026, siyuan recorded 134 security vulnerabilities in the last 90 days, of which 89 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of siyuan and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length PrefixCVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and queryCVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math BlocksCVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset ToolCVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and query | Exploitation statusNot confirmed | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | Exploitation statusNot confirmed | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool | Exploitation statusNot confirmed | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityHigh |
|---|
CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting | Exploitation statusNot confirmed | FixYes | Published10/25/2026 | SeverityHigh |
|---|
CVE-2026-109310SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109309SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-105205SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo | Exploitation statusActively exploited | FixYes | Published10/04/2026 | SeverityMedium |
|---|
CVE-2026-104410SiYuan before 3.8.5 Information Disclosure via /api/export/preview | Exploitation statusActively exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
218 Results | Page 1 of 22