Laurent22 vulnerabilities
30 CVEs and advisories name Laurent22 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-105786Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
- CVE-2026-105785Joplin Server password reset accepts tokens issued for unrelated purposes
- CVE-2026-105784Joplin whiteboard card rendering allows CSS injection into application chrome
- CVE-2026-105783Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
- CVE-2026-46650Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
- CVE-2026-59815Joplin: Pending share recipients can write items into shared folders before accepting invitations
- CVE-2026-55210Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
- CVE-2026-59814Joplin: Stored XSS via inline-served note attachment on published shares
- CVE-2026-55105Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
- CVE-2026-46649Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
- CVE-2026-55179Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
- CVE-2026-59816Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
- CVE-2026-49449Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
- CVE-2026-49453Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
- CVE-2026-49450Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
- CVE-2026-34600Joplin Server delta API returns note content after share access is revoked
- CVE-2025-57798Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input
- CVE-2026-22810Joplin: Path traversal in OneNote importer allows overwriting arbitrary files
- CVE-2025-27134Privilege escalation in Joplin server via user patch endpoint
- CVE-2025-27409Joplin Server Vulnerable to Path Traversal
- CVE-2025-25187Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
- CVE-2025-24028Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin
- CVE-2024-55630DOM Clobbering leads to temporary DOS in the note viewer in Joplin
- CVE-2024-53268Lack of validation on openExternal allows 1 click remote code execution in joplin
- CVE-2024-49362Remote Code Execution on click of <a> Link in markdown preview
- CVE-2024-40643Joplin has a parsing error leading to Cross-site Scripting (XSS)
- CVE-2023-37898Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
- CVE-2023-38506Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin
- CVE-2023-39517Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin
- CVE-2023-45673Arbitrary code execution on click of PDF links in Joplin