Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: siyuan-note siyuan 3.7.4 Clear all filters
TI-2026-44427 CVE-2026-62204 · GHSA-989h-w3q9-3m2f · GHSA-rpx2-p6hp-x5gj

SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

Priority LOW 25

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints.

CVSS 4.0MEDIUM 5.9 Local Low privileges User interaction EPSS 0.00094 Published 2026-08-22 Fixed in 3.7.4, 0.0.0-20260808010544-26ccb40d390e CWE-345
TI-2026-42814 CVE-2026-60084 · GHSA-f62p-x567-xj6g

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

Priority HIGH 70

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll.

CVSS 4.0HIGH 8.4 Network High privileges No interaction EPSS 0.00397 Published 2026-08-22 Fixed in 3.7.4 CWE-22