b3log
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 71 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from November 15, 2017 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)
SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution
SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
Monitor b3log in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.