agentprime: siyuanEvery new CVE for siyuan.https://agentprime.io/CVE-2026-118680: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Aliashttps://agentprime.io/advisories/CVE-2026-118680/https://agentprime.io/advisories/CVE-2026-118680/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 18:59:51 GMTCVECVE-2026-116171: SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefixhttps://agentprime.io/advisories/CVE-2026-116171/https://agentprime.io/advisories/CVE-2026-116171/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:13 GMTCVECVE-2026-116170: SiYuan before v3.8.7 SQL Injection via History Search op and queryhttps://agentprime.io/advisories/CVE-2026-116170/https://agentprime.io/advisories/CVE-2026-116170/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:12 GMTCVECVE-2026-116169: SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blockshttps://agentprime.io/advisories/CVE-2026-116169/https://agentprime.io/advisories/CVE-2026-116169/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:11 GMTCVECVE-2026-116168: SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Toolhttps://agentprime.io/advisories/CVE-2026-116168/https://agentprime.io/advisories/CVE-2026-116168/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:11 GMTCVECVE-2026-116167: SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameterhttps://agentprime.io/advisories/CVE-2026-116167/https://agentprime.io/advisories/CVE-2026-116167/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:10 GMTCVECVE-2026-116166: SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Settinghttps://agentprime.io/advisories/CVE-2026-116166/https://agentprime.io/advisories/CVE-2026-116166/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:09 GMTCVECVE-2026-109310: SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Templatehttps://agentprime.io/advisories/CVE-2026-109310/https://agentprime.io/advisories/CVE-2026-109310/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:06 GMTCVECVE-2026-109309: SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Pathhttps://agentprime.io/advisories/CVE-2026-109309/https://agentprime.io/advisories/CVE-2026-109309/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:05 GMTCVECVE-2026-105205: SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfohttps://agentprime.io/advisories/CVE-2026-105205/https://agentprime.io/advisories/CVE-2026-105205/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:00 GMTCVECVE-2026-104410: SiYuan before 3.8.5 Information Disclosure via /api/export/previewhttps://agentprime.io/advisories/CVE-2026-104410/https://agentprime.io/advisories/CVE-2026-104410/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:37:54 GMTCVECVE-2026-103763: SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfohttps://agentprime.io/advisories/CVE-2026-103763/https://agentprime.io/advisories/CVE-2026-103763/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:37:54 GMTCVECVE-2026-103762: SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpointshttps://agentprime.io/advisories/CVE-2026-103762/https://agentprime.io/advisories/CVE-2026-103762/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:37:53 GMTCVECVE-2026-101092: SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImageshttps://agentprime.io/advisories/CVE-2026-101092/https://agentprime.io/advisories/CVE-2026-101092/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 22:00:17 GMTCVECVE-2026-101091: SiYuan before v3.8.4 SQL Injection via Block Query Embedhttps://agentprime.io/advisories/CVE-2026-101091/https://agentprime.io/advisories/CVE-2026-101091/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 22:00:17 GMTCVECVE-2026-100646: SiYuan before v3.8.4 Authentication Bypass via Missing Origin Headerhttps://agentprime.io/advisories/CVE-2026-100646/https://agentprime.io/advisories/CVE-2026-100646/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:17 GMTCVECVE-2026-100645: SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanbanhttps://agentprime.io/advisories/CVE-2026-100645/https://agentprime.io/advisories/CVE-2026-100645/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:16 GMTCVECVE-2026-100644: SiYuan before v3.8.4 SQL Injection via dailyNoteSavePathhttps://agentprime.io/advisories/CVE-2026-100644/https://agentprime.io/advisories/CVE-2026-100644/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:16 GMTCVECVE-2026-100643: SiYuan before v3.8.4 Stored XSS via Attribute View textareahttps://agentprime.io/advisories/CVE-2026-100643/https://agentprime.io/advisories/CVE-2026-100643/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:15 GMTCVECVE-2026-100642: SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuthhttps://agentprime.io/advisories/CVE-2026-100642/https://agentprime.io/advisories/CVE-2026-100642/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:14 GMTCVECVE-2026-100641: SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Contenthttps://agentprime.io/advisories/CVE-2026-100641/https://agentprime.io/advisories/CVE-2026-100641/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:13 GMTCVECVE-2026-100640: SiYuan before v3.8.4 Clipboard Data Disclosure via IPChttps://agentprime.io/advisories/CVE-2026-100640/https://agentprime.io/advisories/CVE-2026-100640/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:13 GMTCVECVE-2026-100639: SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IALhttps://agentprime.io/advisories/CVE-2026-100639/https://agentprime.io/advisories/CVE-2026-100639/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:12 GMTCVECVE-2026-100638: SiYuan before v3.8.4 Path Traversal via setNotebookIconhttps://agentprime.io/advisories/CVE-2026-100638/https://agentprime.io/advisories/CVE-2026-100638/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:11 GMTCVECVE-2026-100637: SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionIDhttps://agentprime.io/advisories/CVE-2026-100637/https://agentprime.io/advisories/CVE-2026-100637/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:11 GMTCVECVE-2026-100636: SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folderhttps://agentprime.io/advisories/CVE-2026-100636/https://agentprime.io/advisories/CVE-2026-100636/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:10 GMTCVECVE-2026-100635: SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookiehttps://agentprime.io/advisories/CVE-2026-100635/https://agentprime.io/advisories/CVE-2026-100635/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:09 GMTCVECVE-2026-100634: SiYuan before v3.8.4 Missing Authorization via siyuan-send-windowshttps://agentprime.io/advisories/CVE-2026-100634/https://agentprime.io/advisories/CVE-2026-100634/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:09 GMTCVECVE-2026-100633: SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operationshttps://agentprime.io/advisories/CVE-2026-100633/https://agentprime.io/advisories/CVE-2026-100633/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:08 GMTCVECVE-2026-93923: SiYuan through 3.8.4 Stored XSS via Heading Style Attributehttps://agentprime.io/advisories/CVE-2026-93923/https://agentprime.io/advisories/CVE-2026-93923/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 23:12:09 GMTCVECVE-2026-93922: SiYuan through 3.8.4 Stored XSS via notebook nameshttps://agentprime.io/advisories/CVE-2026-93922/https://agentprime.io/advisories/CVE-2026-93922/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 23:12:08 GMTCVECVE-2026-93921: SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpointhttps://agentprime.io/advisories/CVE-2026-93921/https://agentprime.io/advisories/CVE-2026-93921/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 23:12:07 GMTCVECVE-2026-93591: SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.gohttps://agentprime.io/advisories/CVE-2026-93591/https://agentprime.io/advisories/CVE-2026-93591/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 13:20:04 GMTCVECVE-2026-92986: SiYuan before 3.8.4 Cross-Site Scripting via Document Titlehttps://agentprime.io/advisories/CVE-2026-92986/https://agentprime.io/advisories/CVE-2026-92986/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 14:22:10 GMTCVECVE-2026-92985: SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labelshttps://agentprime.io/advisories/CVE-2026-92985/https://agentprime.io/advisories/CVE-2026-92985/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 14:22:09 GMTCVECVE-2026-87815: SiYuan before v3.8.2 Path Traversal via removeRiffDeckhttps://agentprime.io/advisories/CVE-2026-87815/https://agentprime.io/advisories/CVE-2026-87815/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:21:02 GMTCVECVE-2026-87814: SiYuan before v3.8.2 Stored XSS via Asset Previewhttps://agentprime.io/advisories/CVE-2026-87814/https://agentprime.io/advisories/CVE-2026-87814/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:21:01 GMTCVECVE-2026-87813: SiYuan before v3.8.2 Stored XSS via unescaped asset filenameshttps://agentprime.io/advisories/CVE-2026-87813/https://agentprime.io/advisories/CVE-2026-87813/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:21:01 GMTCVECVE-2026-87812: SiYuan before v3.8.2 Stored XSS via Bazaar iconURLhttps://agentprime.io/advisories/CVE-2026-87812/https://agentprime.io/advisories/CVE-2026-87812/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:21:00 GMTCVECVE-2026-87811: SiYuan before v3.8.2 Stored XSS via notebook template pathshttps://agentprime.io/advisories/CVE-2026-87811/https://agentprime.io/advisories/CVE-2026-87811/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:20:59 GMTCVECVE-2026-87810: Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlockhttps://agentprime.io/advisories/CVE-2026-87810/https://agentprime.io/advisories/CVE-2026-87810/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:20:58 GMTCVECVE-2026-87809: Siyuan before v3.8.2 Information Disclosure via Export Previewhttps://agentprime.io/advisories/CVE-2026-87809/https://agentprime.io/advisories/CVE-2026-87809/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:20:58 GMTCVECVE-2026-87808: SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockhttps://agentprime.io/advisories/CVE-2026-87808/https://agentprime.io/advisories/CVE-2026-87808/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:20:57 GMTCVECVE-2026-87807: siyuan before v3.8.2 SQL Injection via fullTextSearchBlockhttps://agentprime.io/advisories/CVE-2026-87807/https://agentprime.io/advisories/CVE-2026-87807/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 11:20:56 GMTCVECVE-2026-86712: SiYuan before 3.8.2 Remote Code Execution via Clipboardhttps://agentprime.io/advisories/CVE-2026-86712/https://agentprime.io/advisories/CVE-2026-86712/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Sep 2026 11:23:05 GMTCVECVE-2026-86192: SiYuan before v3.8.2 Information Disclosure via Attribute-Viewhttps://agentprime.io/advisories/CVE-2026-86192/https://agentprime.io/advisories/CVE-2026-86192/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 12:09:06 GMTCVECVE-2026-86191: SiYuan before v3.8.2 Private Attribute View Key Enumerationhttps://agentprime.io/advisories/CVE-2026-86191/https://agentprime.io/advisories/CVE-2026-86191/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 12:09:06 GMTCVECVE-2026-85585: SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrencyhttps://agentprime.io/advisories/CVE-2026-85585/https://agentprime.io/advisories/CVE-2026-85585/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:29:52 GMTCVECVE-2026-85584: SiYuan before v3.8.2 Denial of Service via Auth Throttlehttps://agentprime.io/advisories/CVE-2026-85584/https://agentprime.io/advisories/CVE-2026-85584/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:29:52 GMTCVECVE-2026-85583: SiYuan before v3.8.2 Path Traversal via symlink in file APIhttps://agentprime.io/advisories/CVE-2026-85583/https://agentprime.io/advisories/CVE-2026-85583/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 11:29:51 GMTCVE