github.com/siyuan-note/siyuan/kernel vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-4WWP-F6GW-6QM5Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)GHSA-3CM4-CCVW-6XR6Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and…GHSA-X8GV-G2G3-65FJHighgithub.com/siyuan-note/siyuan/kernel: SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)GHSA-P23F-CM6Q-2QP8Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)CVE-2026-74904Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode…CVE-2026-74802Lowgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true`…CVE-2026-73606Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents…GHSA-9CQF-HHRQ-7V45Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…CVE-2026-73609Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filteringCVE-2026-73605Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over…CVE-2026-73607Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no…CVE-2026-72788Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan discloses an administrator's open documents and search terms to anonymous readersCVE-2026-69085Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stackingCVE-2026-72789Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully…CVE-2026-72790Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by…GHSA-57V5-WQX3-CGJ4Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by…CVE-2026-72792Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the passwordCVE-2026-72793Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips,…CVE-2026-72795Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document…CVE-2026-72794Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConfCVE-2026-72796Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts…CVE-2026-72797Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readersCVE-2026-72798Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columnsCVE-2026-72799Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readersCVE-2026-72800Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo