CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/01/2023 |
| CVE-2022-40277 | ALTO7.8 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'she | 30/09/2022 |
| CVE-2022-35131 | CRITICO9.0 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. | 25/07/2022 |
| CVE-2021-33295 | MEDIO5.4 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. | 16/06/2022 |
| CVE-2022-23340 | CRITICO9.8 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | 08/02/2022 |
| CVE-2021-23431 | ALTO8.8 | The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. | 24/08/2021 |
| CVE-2021-37916 | MEDIO6.1 | Joplin before 2.0.9 allows XSS via button and form in the note body. | 03/08/2021 |
| CVE-2020-28249 | MEDIO6.1 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. | 06/11/2020 |
| CVE-2020-15930 | MEDIO6.1 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. | 24/09/2020 |
| CVE-2020-9038 | MEDIO5.4 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. | 17/02/2020 |
| CVE-2018-1000534 | MEDIO6.1 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f83 | 26/06/2018 |