b3log
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 70 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from November 15, 2017 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)
SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution
SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client
Monitor b3log in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.