Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
226 results · page 5 of 5
Mar 10, 2026SiYuan is a personal knowledge management system.CVE-2026-31807 · Other software · siyuan-note · reported by GitHubMedium 6.4
SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026SiYuan is a personal knowledge management system.CVE-2026-30869 · Other software · siyuan-note · reported by GitHubCritical 9.3
SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026SiYuan is a personal knowledge management system.CVE-2026-30926 · Other software · siyuan-note · reported by GitHubHigh 7.1
SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026SiYuan is a personal knowledge management system.CVE-2026-29183 · Other software · siyuan-note · reported by GitHubCritical 9.3
SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026SiYuan is a personal knowledge management system.CVE-2026-29073 · Other software · siyuan-note · reported by GitHubMedium 5.7
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026SiYuan is a personal knowledge management system.CVE-2026-25992 · Other software · siyuan-note · reported by GitHubHigh 7.5
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Lute is a structured Markdown engine supporting Go and JavaScript.CVE-2026-25647 · Other software · siyuan-note · reported by GitHubMedium 4.6
Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026SiYuan is a personal knowledge management system.CVE-2026-25539 · Other software · siyuan-note · reported by GitHubCritical 9.1
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026SiYuan is a personal knowledge management system.CVE-2026-23852 · Other software · siyuan-note · reported by GitHubMedium 5.8
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML attributes into the `icon` attribute of a block via the `/api/attr/setBlockAttrs` API. The payload is later rendered in the dynamic icon feature in an unsanitized context, leading to stored XSS and, in the desktop environment, potential remote code execution (RCE). This issue bypasses the previous fix for issue `#15970` (XSS → RCE via dynamic icons). Version 3.5.4 contains an updated fix.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026SiYuan is a personal knowledge management system.CVE-2026-23851 · Other software · siyuan-note · reported by GitHubHigh 8.3
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026SiYuan is a personal knowledge management system.CVE-2026-23850 · Other software · siyuan-note · reported by GitHubHigh 7.8
SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026SiYuan is a personal knowledge management system.CVE-2026-23847 · Other software · siyuan-note · reported by GitHubLow 2.1
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted directly into the SVG <text> tag without XML escaping. Since the response Content-Type is image/svg+xml, injecting unescaped tags allows breaking the XML structure and executing JavaScript. Version 3.5.4 patches the issue.]
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026SiYuan is self-hosted, open source personal knowledge management software.CVE-2026-23645 · Other software · siyuan-note · reported by GitHubMedium 5.3
SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025SiYuan is self-hosted, open source personal knowledge management software.CVE-2025-68948 · Other software · siyuan-note · reported by GitHubMedium 6.9
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SiYuan is self-hosted, open source personal knowledge management software.CVE-2025-67488 · Other software · siyuan-note · reported by GitHubHigh 7.8
SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025SiYuan is self-hosted, open source personal knowledge management software.CVE-2025-21609 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024SiYuan is a personal knowledge management system.CVE-2024-55660 · Other software · siyuan-note · reported by GitHubMedium 6.9
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024SiYuan is a personal knowledge management system.CVE-2024-55659 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024SiYuan is a personal knowledge management system.CVE-2024-55658 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024SiYuan is a personal knowledge management system.CVE-2024-55657 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.CVE-2024-53507 · Other software · siyuan · reported by MITRECritical 9.8
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.CVE-2024-53506 · Other software · siyuan · reported by MITRECritical 9.8
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.CVE-2024-53505 · Other software · siyuan · reported by MITRECritical 9.8
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.CVE-2024-53504 · Other software · siyuan · reported by MITRECritical 9.8
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability has been found in SiYuan 3.1.0 and classified as problematic.CVE-2024-6938 · Other software · b3log · reported by VulDBMedium 5.3
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of the component PDF Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271993 was assigned to this vulnerability.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024SiYuan version 3.0.3 allows executing arbitrary commands on the server.CVE-2024-2692 · Other software · SiYuan · reported by help@fluidattacks.comCritical 9
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Product
- SiYuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.