CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-73049

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-73049 SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

PT-2026-72010

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getAttributeViewBacklinks' endpoint. The system incorrectly consults the forbidden access list instead of the visibility list when filtering backlinks...

CVE-2026-50027: Missing Authentication for Critical Function

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...

CVE-2026-73049: Incorrect Authorization

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to...

PT-2026-72009

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getRefIDsByFileAnnotationID' endpoint. The system returns block identifiers that cite PDF annotations without applying publish-access filtering. This...

Foxit PDF Reader < 2026.1.3 Vulnerability

According to its version, the Foxit PDF Reader application previously named Foxit Reader installed on the remote Windows host is prior to 2026.1.3. It is, therefore affected by vulnerability: - Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified,...

CVE-2026-73606

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

CVE-2026-18622 Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

CVE-2026-73606: Authorization Bypass Through User-Controlled Key

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

CVE-2026-18622: User Interface (UI) Misrepresentation of Critical Information

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mp7r-57w4-5qm3. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns ta...

CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

CVE-2026-72792

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-72805

Affected software: SiYuan before v3.7.4. Root cause: endpoints getBlockBreadcrumb, getRefText, and getBlockTreeInfos do not enforce publish-access checks. Impact: anonymous readers or publish RoleReader accounts can disclose document titles, ancestor block content snippets, reference text, and pa...

CVE-2026-72804

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72804

SiYuan before v3.7.4 has an authentication bypass in the getGraph and getLocalGraph endpoints due to failure to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and view the complete reference topology without supply...