Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

145-76% vs 7-day avg of 598

2 critical, 38 high, 60 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.9	CVE-2026-116170	SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116170SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values Executive summary SiYuan versions before v3.8.7 contain a SQL injection flaw in the history search feature that can expose the contents of the history database. Only holders of an administrator API token can exploit it, and the advisory rates it Moderate with a CVSS score of 4.9. The recommended fix is to upgrade to v3.8.7. Technical summary The flaw is SQL injection (CWE-89) in the history search, where the op field and the query field used when type=3 are concatenated into SQL without escaping, and the resulting statement runs against history.db without a single-statement or read-only check. The advisory states the attack vector is network, complexity low, privileges high (admin token required), no user interaction, with high confidentiality impact and no integrity or availability impact. Affected versions are stated as <= 3.8.6 and the patched version as v3.8.7. The advisory lists remediation as escaping op and query and adding single-statement and read-only checks to the history query functions. No workaround is stated, and no CVE identifier is stated (the advisory says 'No known CVE'). Exploitation in the wild is not stated. Detection guidance beyond the proof of concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4hjx-84f6-gr7c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.1	CVE-2026-116169	SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... siyuan-note, KaTeX, SiYuansiyuan-note siyuan, KaTeX, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116169SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... Executive summary SiYuan, a note-taking application, from version 2.10.0 before 3.8.7 contains a stored cross-site scripting flaw. A user with edit permission can plant a math block that runs attacker script in the application when another user clicks a link in it. The advisory rates the severity as High and the fix is to update to version 3.8.7 or later. Technical summary The flaw is stored cross-site scripting (CWE-79) in math block rendering. KaTeX is run with trust set to true and its output is assigned via innerHTML without sanitization, so a \href, \url, or \includegraphics with a javascript: URL is preserved and executes when a reader clicks the rendered link. Preconditions are edit permission on a document and a victim clicking the link; the advisory notes no click means no execution. Affected versions are stated as 2.10.0 and later (before 3.8.7 per the advisory's range), and the patched version is listed as v3.8.7. No workaround is stated. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhvq-jqv9-pgjq Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note KaTeX SiYuan siyuan-note siyuan KaTeX SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116168	SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... siyuan-note, b3log, SiYuansiyuan-note siyuan, SiYuan, b3log siyuan-note	NVD	Oct 25 14:16 UTC
CVE-2026-116168SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... Executive summary SiYuan, a self-hosted note-taking application, has a path traversal flaw in its MCP asset upload tool that lets an agent-facing caller copy sensitive files from the host, such as a home-directory .env file, into the workspace where they can be read back. The advisory rates it High. The advisory says the fix to be applied is version 3.8.7 and that the vendor's patch is incomplete, since the earlier sensitive-path blacklist omits some secret-bearing filenames. Technical summary The weakness is CWE-22 path traversal with information exposure (CWE-200): the MCP asset upload tool passes file paths through a sensitive-path blacklist (util.IsSensitivePath) that does not cover names such as .env, so a local file is copied into the workspace data/assets directory and served back over HTTP to authenticated sessions. The advisory states affected versions are 3.8.6 and earlier (<= 3.8.6) and the patched version is v3.8.7, but it describes the v3.8.7 fix as incomplete, and it does not state whether 3.8.7 itself fully resolves the issue. Preconditions include an API token for an agent or admin principal driving the MCP server and a file readable by the server process. The advisory's proof of concept was run against v3.8.6 in a Docker lab, and it reports the upload succeeded under the fixed build. No workarounds are stated. No detection guidance is stated. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q768-4j87-gf3w Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note b3log SiYuan siyuan-note siyuan SiYuan b3log siyuan-note NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116167	SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116167SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... Executive summary SiYuan versions from 2.9.0 through 3.8.6 contain a cross-site scripting flaw on the unauthenticated /check-auth page. A victim who opens a crafted link and logs in on that page can have attacker script run inside the authenticated kernel session. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is version 3.8.7. Technical summary The flaw is DOM-based cross-site scripting caused by the to query parameter on /check-auth being assigned to window.location.href without scheme validation, so a javascript: URI runs after a successful login. The attack requires a network-reachable kernel, a victim who opens a crafted link, and a valid access auth code entered by that victim (CVSS AV:N/AC:H/PR:N/UI:R). The advisory states affected versions as >= 2.9.0, <= 3.8.6 and the patched version as v3.8.7. No workaround is stated. Detection guidance is not stated, though the advisory gives a proof-of-concept URL pattern containing a javascript: value in the to parameter. The advisory also states that exploitation in the wild is not mentioned, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116166	SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116166SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS Executive summary SiYuan versions from 3.6.0 up to and including 3.8.6 have a flaw where an administrator setting meant to turn on encrypted HTTPS serving is accepted but not enforced, so the kernel also answers unencrypted HTTP on the same port. A network-adjacent attacker could read login details and session cookies, and the advisory rates the issue Moderate with a CVSS score of 6.8. The fix is to upgrade to version 3.8.7, which the advisory lists as the patched version. Technical summary The weakness is cleartext transmission of sensitive information (CWE-319). The networkServeTLS setting, changed through POST /api/system/setNetworkServeTLS, is persisted but not used to restrict the listener, so the kernel port serves plain HTTP with full API access alongside HTTPS. The session cookie also lacks the Secure attribute and HTTPS responses lack Strict-Transport-Security, which the advisory says compounds the exposure. Affected versions are stated as >= 3.6.0, <= 3.8.6, and the patched version is v3.8.7. The attack vector is Adjacent with high complexity and no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory does not state any workaround other than upgrading, and it does not state whether the flaw is exploited in the wild. The advisory lists No known CVE for this record. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer