CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/01/2023 |
| CVE-2022-40277 | 높음7.8 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'she | 30/09/2022 |
| CVE-2022-35131 | 심각9.0 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. | 25/07/2022 |
| CVE-2021-33295 | 보통5.4 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. | 16/06/2022 |
| CVE-2022-23340 | 심각9.8 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | 08/02/2022 |
| CVE-2021-23431 | 높음8.8 | The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. | 24/08/2021 |
| CVE-2021-37916 | 보통6.1 | Joplin before 2.0.9 allows XSS via button and form in the note body. | 03/08/2021 |
| CVE-2020-28249 | 보통6.1 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. | 06/11/2020 |
| CVE-2020-15930 | 보통6.1 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. | 24/09/2020 |
| CVE-2020-9038 | 보통5.4 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. | 17/02/2020 |
| CVE-2018-1000534 | 보통6.1 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f83 | 26/06/2018 |