Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: siyuan-note siyuan 3.8.5 Clear all filters
TI-2026-66053 CVE-2026-104410 · GHSA-84pg-x94v-x3xr

SiYuan before 3.8.5 Information Disclosure via /api/export/preview

Priority HIGH 77

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00383 Published 2026-10-02 Fixed in 3.8.5 CWE-862
TI-2026-66035 CVE-2026-103763 · GHSA-cj7w-46vh-93h9

SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo

Priority HIGH 70

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00312 Published 2026-10-02 Fixed in 3.8.5 CWE-200
TI-2026-66034 CVE-2026-103762 · GHSA-7234-66p2-jh2w

SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

Priority HIGH 70

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebo…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00296 Published 2026-10-02 Fixed in 3.8.5 CWE-862