CVE-2026-33203

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on...

CVE-2026-33476

SiYuan kernel has an unauthenticated file-serving endpoint at /appearance/*filepath prior to version 3.6.2. Due to improper path sanitization, an attacker can perform directory traversal and read arbitrary files accessible to the server, bypassing authentication. Multiple sources (NVD, Red Hat ad...