Llaurent22

Products

Exploited and recent CVEs

• CVE-2026-105786 High 8.5 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier 0.4%
• CVE-2026-105785 Medium 4.8 Joplin Server password reset accepts tokens issued for unrelated purposes 0.2%
• CVE-2026-105784 Medium 4.6 Joplin whiteboard card rendering allows CSS injection into application chrome 0.2%
• CVE-2026-105783 High 8.0 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token 0.1%
• CVE-2026-46650 Medium 4.4 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl 0.3%
• CVE-2026-59815 Medium 4.3 Joplin: Pending share recipients can write items into shared folders before accepting invitations 0.2%
• CVE-2026-55210 High 7.4 Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin) 0.5%
• CVE-2026-59814 High 7.6 Joplin: Stored XSS via inline-served note attachment on published shares 0.4%
• CVE-2026-55105 High 7.7 Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer 0.5%
• CVE-2026-46649 Critical 9.1 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint 0.5%
• CVE-2026-55179 Medium 6.5 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID 0.3%
• CVE-2026-59816 Medium 4.3 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash 0.4%
• CVE-2026-49449 Low 2.5 Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows 0.2%
• CVE-2026-49453 High 7.0 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory 0.4%
• CVE-2026-49450 High 7.1 Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName 0.2%
• CVE-2026-34600 Medium 5.7 Joplin Server delta API returns note content after share access is revoked 0.3%
• CVE-2025-57798 Medium 5.5 Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input 0.2%
• CVE-2026-22810 High 8.2 Joplin: Path traversal in OneNote importer allows overwriting arbitrary files 0.2%
• CVE-2025-27134 High 8.8 Privilege escalation in Joplin server via user patch endpoint 2.3%
• CVE-2025-27409 High 7.5 Joplin Server Vulnerable to Path Traversal 0.7%
• CVE-2025-25187 High 7.8 Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin 0.5%
• CVE-2025-24028 High 7.8 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin 0.5%
• CVE-2024-55630 Low 3.3 DOM Clobbering leads to temporary DOS in the note viewer in Joplin 0.3%
• CVE-2024-53268 High 7.3 Lack of validation on openExternal allows 1 click remote code execution in joplin 0.8%
• CVE-2024-49362 High 7.7 Remote Code Execution on click of <a> Link in markdown preview 1.1%
• CVE-2024-40643 Critical 9.7 Joplin has a parsing error leading to Cross-site Scripting (XSS) 0.8%
• CVE-2023-37898 High 8.2 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin 0.4%
• CVE-2023-38506 High 8.2 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin 0.4%
• CVE-2023-39517 High 8.2 Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin 0.5%
• CVE-2023-45673 High 8.9 Arbitrary code execution on click of PDF links in Joplin 1.0%