Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: siyuan-note siyuan 3.7.4 Clear all filters
TI-2026-52623 CVE-2026-74906 · GHSA-x3p9-xqgm-hxww

SiYuan before v3.7.4 Incorrect Authorization via Publish Access

Priority HIGH 77

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00377 Published 2026-08-18 Fixed in 3.7.4 CWE-863
TI-2026-52622 CVE-2026-74905 · GHSA-qrjw-gxw5-x7q9

SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

Priority MEDIUM 64

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00391 Published 2026-08-18 Fixed in 3.7.4 CWE-918
TI-2026-52621 CVE-2026-74904 · GHSA-4vpg-gwqq-w44c

SiYuan before v3.7.4 Missing Authorization via block API

Priority HIGH 77

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb).

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00449 Published 2026-08-18 Fixed in 3.7.4, 0.0.0-20260804015139-bd067a4fe9b2 CWE-862
TI-2026-52620 CVE-2026-74903 · GHSA-rm42-2qwv-9xcq

SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

Priority MEDIUM 57

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00253 Published 2026-08-18 Fixed in 3.7.4 CWE-400
TI-2026-52619 CVE-2026-74902 · GHSA-jwj6-pgg9-m3v5

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

Priority MEDIUM 41

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML.

CVSS 4.0CRITICAL 9.3 Local No auth User interaction EPSS 0.00198 Published 2026-08-18 Fixed in 3.7.4 CWE-79