B3log maintains a focused portfolio of open-source collaboration and documentation tools, including SiYuan, Symphony, Vditor, Solo, and Wide, that are deployed across knowledge-management and note-taking use cases. Despite the modest product count, vulnerabilities affecting this vendor have become more prominent in the landscape and skew strongly toward critical-severity outcomes, reflecting the web-facing and user-input-handling nature of these platforms. The recurring weakness classes center on input neutralization failures—cross-site scripting, SQL injection, and code injection—alongside path-traversal and file-path control issues that are characteristic of web applications handling untrusted user content and file operations. A moderate share of the vendor's disclosures acquire public exploit tooling, making timely patching essential for operators of these systems. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by B3log over time
Signals from CVEs in this vendor scope (70 CVEs).
70 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-34453HIGH SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitor | Mar 31, 2026 | 7.5 | 38 | NO | YES |
CVE-2026-33476HIGH SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to i | Mar 20, 2026 | 7.5 | 37 | NO | YES |
CVE-2026-29183MEDIUM SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getD | Mar 6, 2026 | 6.1 | 35 | NO | YES |
CVE-2026-39846CRITICAL SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. T | Apr 7, 2026 | 9.0 | 34 | NO | NO |
CVE-2026-34605MEDIUM SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated | Mar 31, 2026 | 6.1 | 33 | NO | YES |
CVE-2026-34449CRITICAL SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting th | Mar 31, 2026 | 9.6 | 33 | NO | NO |
CVE-2026-31809MEDIUM SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). | Mar 10, 2026 | 6.1 | 33 | NO | YES |
CVE-2026-31807MEDIUM SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes | Mar 10, 2026 | 6.1 | 33 | NO | YES |
CVE-2026-23852CRITICAL SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML at | Jan 19, 2026 | 9.6 | 33 | NO | NO |
CVE-2026-32767CRITICAL SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the m | Mar 20, 2026 | 9.8 | 32 | NO | NO |
Signals from CVEs in this vendor scope (70 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by B3log.
Media articles that mention a CVE ID that affects a product developed by B3log — matched by CVE ID, not by vendor name.