# B3log Siyuan


- [CVE-2026-32938](https://insights.sbomify.com/CVE-2026-32938/): SiYuan has an Arbitrary File Read in its Desktop Publish Service (critical 9.9)
- [CVE-2026-33669](https://insights.sbomify.com/CVE-2026-33669/): SiYuan has Arbitrary Document Reading within the Publishing Service (critical 9.8)
- [CVE-2026-33670](https://insights.sbomify.com/CVE-2026-33670/): SiYuan has directory traversal within its publishing service (critical 9.8)
- [CVE-2026-32767](https://insights.sbomify.com/CVE-2026-32767/): SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API (critical 9.8)
- [CVE-2024-53504](https://insights.sbomify.com/CVE-2024-53504/): SQL injection in n/a (critical 9.8)
- [CVE-2024-53505](https://insights.sbomify.com/CVE-2024-53505/): SQL injection in n/a (critical 9.8)
- [CVE-2024-53506](https://insights.sbomify.com/CVE-2024-53506/): SQL injection in n/a (critical 9.8)
- [CVE-2024-53507](https://insights.sbomify.com/CVE-2024-53507/): SQL injection in n/a (critical 9.8)
- [CVE-2026-34449](https://insights.sbomify.com/CVE-2026-34449/): SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection (critical 9.7)
- [CVE-2026-32940](https://insights.sbomify.com/CVE-2026-32940/): SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) (critical 9.3)
- [CVE-2026-30869](https://insights.sbomify.com/CVE-2026-30869/): SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage (critical 9.3)
- [CVE-2026-29183](https://insights.sbomify.com/CVE-2026-29183/): SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/products/b3log/siyuan/