SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure...
CVE-2026-72808
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api
2026-08-13 归档
今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the...
CVE-2026-72806
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter tha
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and...
CVE-2026-72803
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoint
SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in...
CVE-2026-72809
SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth f
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb,...
CVE-2026-72805
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeI
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the...
CVE-2026-72802
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that retu
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute...
CVE-2026-72807
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating...
CVE-2026-72789
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly access
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier)...
CVE-2026-72791
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information d
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree...
CVE-2026-72799
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoi
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the...
CVE-2026-72797
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook...
CVE-2026-72790
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that
SiYuan versions before v3.7.4 fail to properly filter related-database content in...
CVE-2026-72798
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymou
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped...
CVE-2026-72801
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthen
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout...
CVE-2026-72788
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to prope
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system...
CVE-2026-72794
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthen
SiYuan versions before v3.7.4 fail to apply publish-access filtering to the...
CVE-2026-72800
SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag...
CVE-2026-72792
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag l
SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in...
CVE-2026-72796
SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass p
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the...
CVE-2026-72795
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and ge