PT-2026-71438

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the local storage filter. Unauthenticated attackers or publish readers can retrieve sensitive data, including closed-tab history, search keywords, private...

CVE-2026-72788 SiYuan before v3.7.4 Information Disclosure via UILayout Filter

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and...

PT-2026-32054

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.x through 3.6.3 Description An issue exists where the '/api/av/removeUnusedAttributeView' endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler passes a...