CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 27/12/2025 |
| CVE-2025-67488 | 高8.8 | SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in | 09/12/2025 |
| CVE-2025-21609 | 緊急9.1 | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion | 03/01/2025 |
| CVE-2024-55660 | 緊急9.8 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 cont | 12/12/2024 |
| CVE-2024-55659 | 中5.4 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. | 12/12/2024 |
| CVE-2024-55658 | 高7.5 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace direct | 12/12/2024 |
| CVE-2024-55657 | 高7.5 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for th | 12/12/2024 |
| CVE-2024-53507 | 緊急9.8 | A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. | 29/11/2024 |
| CVE-2024-53506 | 緊急9.8 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. | 29/11/2024 |
| CVE-2024-53505 | 緊急9.8 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. | 29/11/2024 |
| CVE-2024-53504 | 緊急9.8 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. | 29/11/2024 |
| CVE-2024-6938 | 中5.4 | A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of the component PDF Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and | 21/07/2024 |
| CVE-2024-39150 | 中5.9 | vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. | 05/07/2024 |
| CVE-2024-34449 | 中6.1 | Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true. | 03/05/2024 |
| CVE-2024-2692 | 緊急9.0 | SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS. | 04/04/2024 |
| CVE-2024-23049 | 緊急9.8 | An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. | 05/02/2024 |
| CVE-2021-32855 | 中6.1 | Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue. | 21/02/2023 |
| CVE-2022-0350 | 中5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13. | 31/03/2022 |