Skip to content
Laurent22 vulnerabilities
Newest
-
laurent22 joplin
Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
CVE-2026-105786
8.5 High
-
laurent22 joplin
Joplin Server password reset accepts tokens issued for unrelated purposes
CVE-2026-105785
4.8 Medium
-
laurent22 joplin
Joplin whiteboard card rendering allows CSS injection into application chrome
CVE-2026-105784
4.6 Medium
-
laurent22 joplin
Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
CVE-2026-105783
8.0 High
-
laurent22 joplin
Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
CVE-2026-46650
4.4 Medium
-
laurent22 joplin
Joplin: Pending share recipients can write items into shared folders before accepting invitations
CVE-2026-59815
4.3 Medium
-
laurent22 joplin
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
CVE-2026-55210
7.4 High
-
laurent22 joplin
Joplin: Stored XSS via inline-served note attachment on published shares
CVE-2026-59814
7.6 High
-
laurent22 joplin
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
CVE-2026-55105
7.7 High
-
laurent22 joplin
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
CVE-2026-46649
9.1 Critical
-
laurent22 joplin
Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
CVE-2026-55179
6.5 Medium
-
laurent22 joplin
Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
CVE-2026-59816
4.3 Medium
-
laurent22 joplin
Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
CVE-2026-49449
2.5 Low
-
laurent22 joplin
Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
CVE-2026-49453
7.0 High
-
laurent22 joplin
Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
CVE-2026-49450
7.1 High
-
laurent22 joplin
Joplin Server delta API returns note content after share access is revoked
CVE-2026-34600
5.7 Medium
-
laurent22 joplin
Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input
CVE-2025-57798
5.5 Medium
-
joplinapp joplin, msiemens one2html +1 more
Joplin: Path traversal in OneNote importer allows overwriting arbitrary files
CVE-2026-22810
Fix available
8.2 High
-
joplin project joplin
Privilege escalation in Joplin server via user patch endpoint
CVE-2025-27134
8.8 High
-
joplin project joplin
Joplin Server Vulnerable to Path Traversal
CVE-2025-27409
7.5 High
-
joplin project joplin
Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
CVE-2025-25187
7.8 High
-
joplin project joplin
Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin
CVE-2025-24028
Fix available
7.8 High
-
joplin project joplin
DOM Clobbering leads to temporary DOS in the note viewer in Joplin
CVE-2024-55630
3.3 Low
-
joplin project joplin
Lack of validation on openExternal allows 1 click remote code execution in joplin
CVE-2024-53268
7.3 High
-
joplin project joplin
Remote Code Execution on click of <a> Link in markdown preview
CVE-2024-49362
Fix available
7.7 High
-
joplin project joplin
Joplin has a parsing error leading to Cross-site Scripting (XSS)
CVE-2024-40643
9.7 Critical
-
joplin project joplin
Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
CVE-2023-37898
8.2 High
-
joplin project joplin
Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin
CVE-2023-38506
8.2 High
-
joplin project joplin
Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin
CVE-2023-39517
8.2 High
-
joplin project joplin
Arbitrary code execution on click of PDF links in Joplin
CVE-2023-45673
8.9 High