github.com/siyuan-note/siyuan/kernel vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-72801Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline…CVE-2026-72802Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPathCVE-2026-72803Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields)…CVE-2026-72804Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documentsCVE-2026-72805Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of…CVE-2026-72806Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents…CVE-2026-72807Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on…CVE-2026-72808Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)CVE-2026-72809Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxyCVE-2026-72810Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including…CVE-2026-72811Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and…CVE-2026-72812Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated…CVE-2026-68584Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)CVE-2026-68585Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden…CVE-2026-68586Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of…CVE-2026-68587Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable…CVE-2026-69083Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method…CVE-2026-69086Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view…CVE-2026-69084Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle,…GHSA-GW25-M53R-QH88Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)GHSA-99RQ-75J6-5J9FHighgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypassCVE-2026-59832Highgithub.com/siyuan-note/siyuan/kernel: Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbCVE-2026-59834Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentCVE-2026-50551Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentCVE-2026-54158Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo