siyuan-note

Six ways to organize scattered notes | 6 open-source choices Choose a workflow for scattered notes. Six options, with different use cases and adoption checks. NoteGen, Lumina Note, ReadAny, Yank Note, Markra, SiYuan. Explore the original cards: channel profile → AI Open Source Radar → Collections. Choose the collection for this task and inspect the project cards. useaistation.com Sources checked 23 Oct 2026. This is a project-selection guide, not hands-on testing or a live ranking. These are different choices, not a verified integrated stack. Software licenses, model weights, hardware and external service costs must be checked separately. Community/core and enterprise features may differ. Developer disclosure: we build AI Open Source Radar, not the featured projects. Narration: Microsoft free Aria neural voice. Project and License sources (observed branch references, subject to change): NoteGen: codexu/note-gen License: raw.githubusercontent.com Lumina Note: blueberrycongee/Lumina-Note License: raw.githubusercontent.com ReadAny: codedogQBY/ReadAny License: raw.githubusercontent.com Yank Note: purocean/yn License: raw.githubusercontent.com Markra: markrahq/markra License: raw.githubusercontent.com SiYuan: siyuan-note/siyuan License: raw.githubusercontent.com #OpenSource #AITools #KnowledgeManagement

3. 필기하다 골라둔 문장을 복습 카드로 꺼내줘요. 대부분 기능은 무료이고 일부만 유료예요. siyuan-note/siyuan

CVE-2026-62204: CVE-2026-62204: Arbitrary Bazaar Package Overwrite in SiYuan via Parameter Mismatch CVE-2026-62204: Arbitrary Bazaar Package Overwrite in SiYuan via Parameter Mismatch > Vulnerability ID: CVE-2026-62204 > CVSS Score: 6.6 > Published: 2026-10-23 An insufficient verification of data authenticity vulnerability in SiYuan prior to version 3.7.4 allows an attacker to overwrite arbitrary installed marketplace packages (plugins, widgets, themes, and templates). By providing a mismatched package name and package archive repository URL during a Bazaar installation request, arbitrary file write into trusted plugin directories can be achieved, enabling persistence and execution across application restarts. TL;DR Decoupled parameter handling in SiYuan's Bazaar installer allowed package archives to overwrite arbitrary installed plugins without validating package manifest consistency. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-345 - Attack Vector: Local / API Request - CVSS v3.1 Score: 6.6 (Medium) - CVSS v4.0 Score: 5.9 (Medium) - EPSS Score: 0.00094 (0.56th percentile) - Exploit Status: Proof of Concept / Advisory Stage - CISA KEV Status: Not Listed Affected Systems - SiYuan personal knowledge management system (versions prior to v3.7.4) Mitigation Strategies - Upgrade SiYuan instance to version v3.7.4 or later. - Restrict local API access to trusted same-origin environments. - Audit installed Bazaar packages in the workspace data directory for unexpected file changes. Remediation Steps: 1. Download and apply SiYuan release v3.7.4 or v3.8.0+. 2. Restart the SiYuan application kernel to apply updated binary logic. 3. Verify that plugin installation logic rejects installation requests when package manifest names mismatch client parameters. References - GitHub Security Advisory GHSA-rpx2-p6hp-x5gj - SiYuan Commit 26ccb40d390eb7d9b04673629a58ab1d69cc7e53 - VulnCheck Advisory for CVE-2026-62204 - SiYuan Release v3.8.0 Tag - CVE-2026-62204 Record --- Read the full report for CVE-2026-62204 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-9CQF-HHRQ-7V45: Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to… Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to unauthorized readers > Vulnerability ID: GHSA-9CQF-HHRQ-7V45 > CVSS Score: 5.3 > Published: 2026-10-01 An authorization bypass and information leakage vulnerability exists in the SiYuan database module. Unauthenticated users can query the getAttributeViewSearchTarget API endpoint using target block identifiers to extract private content. TL;DR Missing publish-access check on the /api/av/getAttributeViewSearchTarget endpoint in SiYuan allows unauthorized substring-based extraction of private database row contents. --- Technical Details - CWE ID: CWE-862, CWE-200 - Attack Vector: Network - CVSS v3.1 Score: 5.3 (Medium) - Exploit Status: Proof-of-Concept - KEV Status: Not Listed Affected Systems - SiYuan Knowledge Workspace Platform - SiYuan: < 3.8.0 (Fixed in: 3.8.0) Code Analysis Commit: 9b8e895 Add getAttributeViewSearchTarget endpoint Mitigation Strategies - Apply server-side publish-access middleware to validate block accessibility. - Restrict API endpoint access via network ACLs or reverse proxy configuration. - Disable public publishing features if private data is stored. Remediation Steps: 1. Upgrade SiYuan to version 3.8.0 or later where access checks are properly enforced. 2. Configure reverse proxy rules to block external access to /api/av/getAttributeViewSearchTarget. 3. Audit published notebooks to ensure no private database blocks are referenced. --- Read the full report for GHSA-9CQF-HHRQ-7V45 on our website for more details including interactive diagrams and full exploit analysis.

Your notes need links, not more folders. 🗂️ SiYuan organizes ideas with block references and backlinks. A local-first workspace for research notes and personal knowledge. ✍️ siyuan-note/siyuan #KnowledgeBase #浇朋友 #蓝朋友 #互关 #fo

笔记越多，知识点越难串起来？🗂️ 思源笔记用块引用和双向链接整理内容，支持本地使用与自托管。写研究笔记很顺手。✍️ siyuan-note/siyuan #KnowledgeBase #浇朋友 #蓝朋友 #互关 #fo

笔记越写越多，知识却连不起来？📝 思源笔记支持块级引用、双向链接和本地数据存储。 整理课程和研究笔记很顺手。🧠 siyuan-note/siyuan #Notes #KnowledgeBase #浇朋友 #蓝朋友 #互关 #fo

「SiYuan」 プライバシーファーストかつセルフホストに対応したオープンソースの知識ワークスペース ブロックレベルの双方向リンクやMarkdown完全WYSIWYGエディタを備え、AIエージェントとの連携やデータベース機能も搭載 siyuan-note/siyuan #SiYuan #ナレッジマネジメント #Markdown #AI t.co