CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/01/2023 |
| CVE-2022-40277 | 高危7.8 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'she | 30/09/2022 |
| CVE-2022-35131 | 严重9.0 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. | 25/07/2022 |
| CVE-2021-33295 | 中危5.4 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. | 16/06/2022 |
| CVE-2022-23340 | 严重9.8 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | 08/02/2022 |
| CVE-2021-23431 | 高危8.8 | The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. | 24/08/2021 |
| CVE-2021-37916 | 中危6.1 | Joplin before 2.0.9 allows XSS via button and form in the note body. | 03/08/2021 |
| CVE-2020-28249 | 中危6.1 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. | 06/11/2020 |
| CVE-2020-15930 | 中危6.1 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. | 24/09/2020 |
| CVE-2020-9038 | 中危5.4 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. | 17/02/2020 |
| CVE-2018-1000534 | 中危6.1 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f83 | 26/06/2018 |