Overview 23 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
23matches
1in Waratek scope4.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
4.3%
Outside Waratek scope
0
0.0%
Not applicable
22
95.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
23
100.0%
split by
peak 6 / year
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20182
Not applicable2
Critical1
Medium1
not blocked2
No public exploit2
20195
No exploit published1
Not applicable4
High1
Medium4
not blocked5
No public exploit5
20200
20210
20223
Not applicable3
Medium3
not blocked3
No public exploit3
20230
20246
Not applicable6
High3
Medium3
not blocked6
No public exploit6
20251
Not applicable1
High1
not blocked1
No public exploit1
20265
Not applicable5
High3
Medium2
not blocked5
No public exploit5
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-40318 | High | 2026-04-16 | Not applicable | No public exploit | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4. |
| CVE-2026-25647 | Medium | 2026-02-06 | Not applicable | No public exploit | Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session. |
| CVE-2026-23852 | Medium | 2026-01-19 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML attributes into the `icon` attribute of a block via the `/api/attr/setBlockAttrs` API. The payload is later rendered in the dynamic icon feature in an unsanitized context, leading to stored XSS and, in the desktop environment, potential remote code execution (RCE). This issue bypasses the previous fix for issue `#15970` (XSS → RCE via dynamic icons). Version 3.5.4 contains an updated fix. |
| CVE-2026-23851 | High | 2026-01-19 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue. |
| CVE-2026-23850 | High | 2026-01-19 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue. |
| CVE-2025-21609 | High | 2025-01-03 | Not applicable | No public exploit | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19. |
| CVE-2024-55660 | Medium | 2024-12-12 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue. |
| CVE-2024-55659 | High | 2024-12-12 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. |
| CVE-2024-55658 | High | 2024-12-12 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue. |
| CVE-2024-55657 | High | 2024-12-12 | Not applicable | No public exploit | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue. |
| CVE-2024-39150 | Medium | 2024-07-05 | Not applicable | No public exploit | vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. |
| CVE-2024-34449 | Medium | 2024-05-03 | Not applicable | No public exploit | Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true. |
| CVE-2022-0350 | Medium | 2022-03-31 | Not applicable | No public exploit | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13. |
| CVE-2022-0341 | Medium | 2022-03-14 | Not applicable | No public exploit | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12. |
| CVE-2021-4103 | Medium | 2022-01-23 | Not applicable | No public exploit | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 1.0.34. |
| CVE-2019-17488 | Medium | 2019-10-10 | Not applicable | No public exploit | b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. |
| CVE-2019-13915 | High | 2019-07-18 | Not applicable | No public exploit | b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access. |
| CVE-2018-16249 | Medium | 2019-06-20 | Not applicable | No public exploit | In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name. |
| CVE-2018-16248 | Medium | 2019-06-20 | Not applicable | No public exploit | b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request. |
| CVE-2019-9142 | Medium | 2019-02-25 | No exploit published | No public exploit | An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java. |
| CVE-2018-16805 | Medium | 2018-09-10 | Not applicable | No public exploit | In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator. |
| CVE-2018-10469 | Critical | 2018-04-27 | Not applicable | No public exploit | b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI. |
| CVE-2017-16821 | Medium | 2017-11-15 | Not applicable | No public exploit | b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid. |