What’s Vulnerable › Products
laurent22 joplin vulnerabilities
39 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your laurent22 joplin version is affected
Latest laurent22 joplin vulnerabilities
- CVE-2026-105786 — Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier (CVSS 8.5)
- CVE-2026-105785 — Joplin Server password reset accepts tokens issued for unrelated purposes (CVSS 4.8)
- CVE-2026-105784 — Joplin whiteboard card rendering allows CSS injection into application chrome (CVSS 4.6)
- CVE-2026-105783 — Joplin Web Clipper pairing allows cross-origin theft of a permanent API token (CVSS 8.0)
- CVE-2026-59815 — Joplin: Pending share recipients can write items into shared folders before accepting invitations (CVSS 4.3)
- CVE-2026-59814 — Joplin: Stored XSS via inline-served note attachment on published shares (CVSS 7.6)
- CVE-2026-55210 — Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin) (CVSS 7.4)
- CVE-2026-46650 — Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl (CVSS 4.4)
- CVE-2026-59816 — Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash (CVSS 4.3)
- CVE-2026-55179 — Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (CVSS 6.5)
- CVE-2026-55105 — Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer (CVSS 7.7)
- CVE-2026-49453 — Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory (CVSS 7.0)
- CVE-2026-49450 — Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName (CVSS 7.1)
- CVE-2026-49449 — Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows (CVSS 2.5)
- CVE-2026-46649 — Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (CVSS 9.1)
- CVE-2026-34600 — Joplin Server delta API returns note content after share access is revoked (CVSS 5.7)
- CVE-2025-57798 — Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input (CVSS 5.5)
- CVE-2025-27409 — Joplin Server Vulnerable to Path Traversal (CVSS 7.5)
- CVE-2025-27134 — Privilege escalation in Joplin server via user patch endpoint (CVSS 8.8)
- CVE-2025-25187 — Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin (CVSS 5.4)
- CVE-2025-24028 — Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin (CVSS 9.6)
- CVE-2024-55630 — DOM Clobbering leads to temporary DOS in the note viewer in Joplin (CVSS 5.5)
- CVE-2024-53268 — Lack of validation on openExternal allows 1 click remote code execution in joplin (CVSS 8.8)
- CVE-2024-49362 — Remote Code Execution on click of <a> Link in markdown preview (CVSS 9.6)
- CVE-2024-40643 — Joplin has a parsing error leading to Cross-site Scripting (XSS) (CVSS 9.6)