CVE-2026-116166Medium· 6.8▾ SunlitSiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
siyuan >= 3.6.0 < 3.8.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100635Medium· 5.9SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections
CVE-2026-116167Medium· 6.8SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
CVE-2026-116168Medium· 6.2SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
CVE-2026-116169Medium· 5.4SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
CVE-2026-116170Medium· 4.9SiYuan before v3.8.7 SQL Injection via History Search op and query
CVE-2026-116171High· 7.5SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix