Betroffene Versionslinien
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-105786 | Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier | * | 8.5 | — | 2026-10-06 | |
| CVE-2026-105785 | Joplin Server password reset accepts tokens issued for unrelated purposes | * | 4.8 | — | 2026-10-06 | |
| CVE-2026-105784 | Joplin whiteboard card rendering allows CSS injection into application chrome | * | 4.6 | — | 2026-10-06 | |
| CVE-2026-105783 | Joplin Web Clipper pairing allows cross-origin theft of a permanent API token | * | 8.0 | — | 2026-10-06 | |
| CVE-2026-46650 | Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl | * | 4.4 | — | 2026-09-22 | |
| CVE-2026-59815 | Joplin: Pending share recipients can write items into shared folders before accepting invitations | * | 4.3 | — | 2026-09-22 | |
| CVE-2026-55210 | Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin) | * | 7.4 | — | 2026-09-22 | |
| CVE-2026-59814 | Joplin: Stored XSS via inline-served note attachment on published shares | * | 7.6 | — | 2026-09-22 | |
| CVE-2026-55105 | Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer | * | 7.7 | — | 2026-09-22 | |
| CVE-2026-46649 | Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpo... | * | 9.1 | — | 2026-09-22 | |
| CVE-2026-55179 | Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID | * | 6.5 | — | 2026-09-22 | |
| CVE-2026-59816 | Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash | * | 4.3 | — | 2026-09-22 | |
| CVE-2026-49449 | Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Win... | * | 2.5 | — | 2026-09-22 | |
| CVE-2026-49453 | Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory | * | 7.0 | — | 2026-09-22 | |
| CVE-2026-49450 | Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no... | * | 7.1 | — | 2026-09-22 | |
| CVE-2026-34600 | Joplin Server delta API returns note content after share access is revoked | * | 5.7 | — | 2026-05-20 | |
| CVE-2025-57798 | Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input | * | 5.5 | — | 2026-05-20 | |
| CVE-2026-22810 | Joplin: Path traversal in OneNote importer allows overwriting arbitrary files | * < 3.5.7 | 7.3 | — | 2026-05-18 | |
| CVE-2025-27409 | Joplin Server Vulnerable to Path Traversal | * < 3.3.3 | 7.5 | — | 2025-04-30 | |
| CVE-2025-27134 | Privilege escalation in Joplin server via user patch endpoint | * < 3.3.3 | 8.8 | — | 2025-04-30 | |
| CVE-2025-24028 | Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin | * < 3.2.12 | 9.6 | — | 2025-02-07 | |
| CVE-2025-25187 | Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin | * < 3.1.24 | 5.4 | — | 2025-02-07 | |
| CVE-2024-55630 | DOM Clobbering leads to temporary DOS in the note viewer in Joplin | * < 3.2.8 | 5.5 | — | 2025-02-07 | |
| CVE-2024-53268 | Lack of validation on openExternal allows 1 click remote code execution in joplin | * < 3.0.3 | 8.8 | — | 2024-11-25 | |
| CVE-2024-49362 | Remote Code Execution on click of <a> Link in markdown preview | * < 3.1 | 9.6 | — | 2024-11-14 | |
| CVE-2024-40643 | Joplin has a parsing error leading to Cross-site Scripting (XSS) | * < 3.0.15 | 9.6 | — | 2024-09-09 | |
| CVE-2023-38506 | Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin | * < 2.12.10 | 5.4 | — | 2024-06-21 | |
| CVE-2023-45673 | Arbitrary code execution on click of PDF links in Joplin | * < 2.13.3 | 9.0 | — | 2024-06-21 | |
| CVE-2023-39517 | Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin | * < 2.12.8 | 5.4 | — | 2024-06-21 | |
| CVE-2023-37898 | Safe mode Cross-site Scripting (XSS) vulnerability in Joplin | * < 2.12.9 | 5.4 | — | 2024-06-21 | |
| CVE-2023-37298 | Joplin before 2.11.5 allows XSS via a USE element in an SVG document. | * < 2.11.5 | 6.1 | — | 2023-06-30 | |
| CVE-2023-37299 | Joplin before 2.11.5 allows XSS via an AREA element of an image map. | * < 2.11.5 | 6.1 | — | 2023-06-30 | |
| CVE-2022-45598 | Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary c... | * < 2.9.17 | 6.1 | — | 2023-01-31 | |
| CVE-2022-35131 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titl... | * = 2.8.8 | 9.0 | — | 2022-07-25 | |
| CVE-2021-33295 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribra... | * < 1.8.5 | 5.4 | — | 2022-06-16 | |
| CVE-2022-23340 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results... | * = 2.6.10 | 9.8 | — | 2022-02-08 | |
| CVE-2021-23431 | Cross-site Request Forgery (CSRF) | < 2.3.2 | 8.8 | — | 2021-08-24 | |
| CVE-2021-37916 | Joplin before 2.0.9 allows XSS via button and form in the note body. | * < 2.0.9 | 6.1 | — | 2021-08-03 | |
| CVE-2020-28249 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. | * = 1.2.6 | 6.1 | — | 2020-11-06 | |
| CVE-2020-15930 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed t... | * ≥ 1.0.190 ≤ 1.0.245 | 6.1 | — | 2020-09-24 | |
| CVE-2020-9038 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. | * ≤ 1.0.184 | 5.4 | — | 2020-02-17 | |
| CVE-2018-1000534 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for... | * < 1.0.90 | 6.1 | — | 2018-06-26 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).