S
Vendor security profile
siyuan-note
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs128
Critical39
CISA KEV0
Public exploit81
Patch rate%14
Avg. CVSS8.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
7
81
34
6
CVE KEV
CVE severity distribution
128toplam CVE
Critical39 (30%)
High48 (38%)
Medium40 (31%)
Low1 (1%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%63
Public exploit
18Patch available
0Partial
0Workaround
0Vendor: no patch
110Unknown
Latest vulnerabilities
7.1
CVE-2026-109310
SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
S
Patch status unknownEPSS %0
6.9
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
S
Patch verifiedEPSS %0
6.9
CVE-2026-105205
SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
S
Patch status unknownEPSS %0
8.7
CVE-2026-104410
SiYuan before 3.8.5 Information Disclosure via /api/export/preview
S
Patch status unknownEPSS %0
6.9
CVE-2026-103763
SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
S
Patch status unknownEPSS %0
6.9
CVE-2026-103762
SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
S
Patch status unknownEPSS %0
6.9
CVE-2026-101092
SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
S
Patch verifiedEPSS %0
7.1
CVE-2026-101091
SiYuan before v3.8.4 SQL Injection via Block Query Embed
S
Patch verifiedEPSS %0
8.6
CVE-2026-100646
SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
S
Patch status unknownEPSS %0
8.6
CVE-2026-100645
SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
S
Patch status unknownEPSS %0