CVE-2026-116166

The SiYuan note-taking application (versions 3.6.0 before 3.8.7 ) is vulnerable to cleartext transmission of sensitive information (CWE-319). Although the application accepts and persists the networkServeTLS setting, it fails to enforce it, allowing the kernel port to serve full API access over p...

EUVD-2026-109427

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute...