10
CVEs
5
Critical
5
High
0
KEV
2
PoC
1
Unpatched C/H
90.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
5
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (12)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-34605 | Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers to execute arbitrary JavaScript via the unauthenticated /api/icon/getDynamicIcon endpoint by bypassing SVG sanitization using XML namespace-prefixed element names. The vulnerability exploits a parser inconsistency where Go's HTML5 parser treats 'x:script' as a distinct tag while browsers' XML parsers resolve the namespace prefix to execute the script. Publicly available exploit code exists (GitHub issue #17246 documents the bypass technique), though no CISA KEV listing indicates mass exploitation campaigns at time of analysis. | HIGH | 8.6 | 0.0% | 63 |
PoC
|
| CVE-2026-34453 | Unauthenticated information disclosure in SiYuan personal knowledge management system versions before 3.6.2 allows remote attackers to retrieve confidential content from password-protected documents via the publish service's bookmark API endpoint. The vulnerability bypasses document-level access controls by treating nil authentication contexts as authorized during bookmark filtering, exposing any bookmarked blocks without password verification. CVSS 7.5 (High) with network-based exploitation requiring no privileges or user interaction; no public exploit identified at time of analysis, though the security advisory provides detailed technical disclosure. | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2026-32938 | SiYuan personal knowledge management system versions 3.6.0 and below contain a path traversal vulnerability that allows authenticated attackers to exfiltrate arbitrary readable files from the system. An attacker with low-level privileges can exploit the /api/lute/html2BlockDOM endpoint to copy sensitive files to the workspace assets directory via malicious file:// links in pasted HTML, then retrieve them through the authenticated GET /assets/ endpoint. This is a critical vulnerability with a CVSS score of 9.9 due to its potential for high confidentiality impact and scope change, though no active exploitation (KEV) or public proof-of-concept has been documented. | CRITICAL | 9.9 | 0.1% | 50 |
|
| CVE-2026-34449 | Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to execute arbitrary code with full operating system privileges through CORS misconfiguration. A malicious website can inject JavaScript into the Electron-based application's Node.js context via the permissive API (Access-Control-Allow-Origin: * with Access-Control-Allow-Private-Network: true), which executes with OS-level access when the user next opens SiYuan's interface. No public exploit identified at time of analysis, though CVSS 9.6 (Critical) reflects network-accessible attack vector with low complexity requiring only user interaction (visiting malicious site while SiYuan runs). EPSS data not provided, but the combination of Electron framework exploitation, RCE impact, and trivial attack complexity suggests elevated real-world risk for desktop users. | CRITICAL | 9.6 | 0.1% | 48 |
|
| CVE-2026-32940 | SiYuan personal knowledge management system contains a cross-site scripting (XSS) vulnerability in versions 3.6.0 and below. An unauthenticated attacker can exploit the /api/icon/getDynamicIcon endpoint by crafting a malicious URL that bypasses SVG sanitization filters, allowing arbitrary JavaScript execution when a victim clicks an injected link within the rendered SVG. The CVSS score of 9.3 indicates critical severity, though exploitation requires user interaction (clicking a malicious link) and the attack complexity is low. | CRITICAL | 9.3 | 0.0% | 47 |
|
| CVE-2026-34448 | Stored cross-site scripting (XSS) in SiYuan personal knowledge management system escalates to arbitrary operating system command execution on desktop clients. Authenticated attackers with low privileges can inject malicious URLs into Attribute View asset fields that execute JavaScript when victims view Gallery or Kanban layouts with "Cover From -> Asset Field" enabled. The Electron desktop client's configuration (nodeIntegration enabled, contextIsolation disabled) allows the XSS payload to break sandbox boundaries and execute arbitrary commands under the victim's OS account. CVSS 9.0 (Critical) with network attack vector, low complexity, and cross-scope impact. Vendor-released patch: version 3.6.2. No public exploit identified at time of analysis, though technical details are disclosed in GitHub advisory GHSA-rx4h-526q-4458. | CRITICAL | 9.0 | 0.0% | 45 |
|
| CVE-2026-40322 | Stored cross-site scripting escalating to remote code execution in SiYuan (b3log) versions 3.6.3 and below, where Mermaid diagrams render with securityLevel 'loose' and inject SVG via innerHTML, letting javascript: URLs in Mermaid code blocks survive into the DOM. On Electron desktop builds — created with nodeIntegration enabled and contextIsolation disabled — a victim opening a note with a malicious Mermaid block and clicking the diagram node triggers arbitrary code execution. Publicly available exploit code exists (SSVC 'poc'); not listed in CISA KEV, and EPSS is very low at 0.05%. | CRITICAL | 9.0 | 0.0% | 45 |
No patch
|
| CVE-2026-40107 | NTLM credential theft in SiYuan personal knowledge management system (prior to 3.6.4) allows remote attackers to capture Windows user password hashes without authentication or user interaction. Misconfigured Mermaid.js rendering with securityLevel:loose permits unsanitized <img> tags within SVG foreignObject blocks. Protocol-relative URLs in malicious Mermaid diagrams trigger automatic SMB authentication on Windows, transmitting NTLMv2 hashes to attacker-controlled servers when victims open compromised notes. Electron client processes the SVG via innerHTML without secondary sanitization, enabling SSRF to UNC paths. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-34585 | Stored cross-site scripting (XSS) in SiYuan personal knowledge management system versions prior to 3.6.2 escalates to remote code execution in the Electron desktop client. Attackers craft malicious .sy.zip import files containing HTML entities mixed with raw special characters that bypass server-side attribute escaping, injecting event handlers into imported notes. When victims open the compromised note in the Electron client, injected JavaScript executes with full Node/Electron API access, enabling arbitrary code execution. CVSS 8.6 (High) with local attack vector requiring user interaction; no public exploit identified at time of analysis. | HIGH | 8.6 | 0.1% | 43 |
|
| CVE-2026-40318 | Arbitrary server-side file deletion in SiYuan (b3log/SiYuan) versions 3.6.3 and prior lets a low-privileged actor with access to the /api/av/removeUnusedAttributeView endpoint - such as a Reader-role or publish context - supply an id parameter containing ../ sequences to escape the storage/av directory and delete any .json file on the server, including conf/conf.json and workspace metadata. The GitHub Security Advisory (GHSA-vw86-c94w-v3x4) includes step-by-step reproduction, so publicly available exploit code exists, but there is no public exploit identified as weaponized and SSVC exploitation status is 'none'; EPSS is low at 0.06%. Fixed in version 3.6.4. | HIGH | 8.5 | 0.1% | 43 |
|