b3log has 7 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The busiest recent month was March 2026 with 3. The median CVSS is 7.8 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: siyuan (5), Solo (1), Symphony (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-34453High· 7.5SiYuan is a personal knowledge management system53CVE-2026-34449Critical· 9.6SiYuan is a personal knowledge management system53CVE-2026-34448Critical· 9.0SiYuan is a personal knowledge management system50CVE-2025-68948High· 8.1SiYuan is self-hosted, open source personal knowledge management software45CVE-2025-67488High· 7.8SiYuan is self-hosted, open source personal knowledge management software43
b3log vulnerabilities
CVEs affecting b3log, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-111610Medium· 5.4PoCB3log Solo through 4.4.0 Missing Authorization in ArticleConsole
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articl…
CVE-2026-110105Medium· 5.3PoCB3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can req…
CVE-2026-34453High· 7.5PoCSiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark f…
CVE-2026-34449Critical· 9.6SiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * …
CVE-2026-34448Critical· 9.0SiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -…
CVE-2025-68948High· 8.1SiYuan is self-hosted, open source personal knowledge management software
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session…
CVE-2025-67488High· 7.8SiYuan is self-hosted, open source personal knowledge management software
SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite fil…