Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: siyuan-note siyuan 3.7.4 Clear all filters
TI-2026-51694 CVE-2026-73610 · GHSA-8j5p-6pf5-6pqc

SiYuan before v3.7.4 Information Disclosure via Local Storage

Priority MEDIUM 64

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00259 Published 2026-08-13 Fixed in 3.7.4 CWE-639
TI-2026-51693 CVE-2026-73609 · GHSA-j4ph-9xwf-wcj4

SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

Priority LOW 36

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-13 Fixed in 3.7.4, 0.0.0-20260812083335-251596fc0de2 CWE-862
TI-2026-51691 CVE-2026-73607 · GHSA-53fp-9jmv-227g

SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

Priority HIGH 70

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00252 Published 2026-08-13 Fixed in 3.7.4, 0.0.0-20260812083335-251596fc0de2 CWE-862
TI-2026-51690 CVE-2026-73606 · GHSA-vg99-7gj7-2fr5

SiYuan before v3.7.4 Information Disclosure via getRefIDs

Priority HIGH 70

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-13 Fixed in 3.7.4, 0.0.0-20260812083335-251596fc0de2 CWE-639
TI-2026-51689 CVE-2026-73605 · GHSA-hf8h-97gm-4x2p

SiYuan before v3.7.4 Path Traversal via getUniqueFilename

Priority LOW 36

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-13 Fixed in 3.7.4, 0.0.0-20260812083335-251596fc0de2 CWE-862