B3log Siyuan vulnerabilities
55 published vulnerabilities in B3log Siyuan. The most were published in 2026 (42), and 42 so far in 2026.
B3log Siyuan vulnerabilities by year
2024
2025
2026
Most exploited B3log Siyuan vulnerabilities
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
- CVE-2024-53505 SQL injection in n/a
- CVE-2024-53506 SQL injection in n/a
- CVE-2024-53507 SQL injection in n/a
- CVE-2026-34449 SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
- CVE-2026-32940 SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
- CVE-2026-30869 SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
- CVE-2026-29183 SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.