# cve.now: Laurent22

The newest entries naming Laurent22 as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-105786](https://cve.now/CVE-2026-105786.md): Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier (CVSS 8.5)
- [CVE-2026-105785](https://cve.now/CVE-2026-105785.md): Joplin Server password reset accepts tokens issued for unrelated purposes (CVSS 4.8)
- [CVE-2026-105784](https://cve.now/CVE-2026-105784.md): Joplin whiteboard card rendering allows CSS injection into application chrome (CVSS 4.6)
- [CVE-2026-105783](https://cve.now/CVE-2026-105783.md): Joplin Web Clipper pairing allows cross-origin theft of a permanent API token (CVSS 8.0)
- [CVE-2026-46650](https://cve.now/CVE-2026-46650.md): Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl (CVSS 4.4)
- [CVE-2026-59815](https://cve.now/CVE-2026-59815.md): Joplin: Pending share recipients can write items into shared folders before accepting invitations (CVSS 4.3)
- [CVE-2026-55210](https://cve.now/CVE-2026-55210.md): Joplin: SAML SSO account takeover via email-based account linking (missing is\_external check in ssoLogin) (CVSS 7.4)
- [CVE-2026-59814](https://cve.now/CVE-2026-59814.md): Joplin: Stored XSS via inline-served note attachment on published shares (CVSS 7.6)
- [CVE-2026-55105](https://cve.now/CVE-2026-55105.md): Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer (CVSS 7.7)
- [CVE-2026-46649](https://cve.now/CVE-2026-46649.md): Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (CVSS 9.1)
- [CVE-2026-55179](https://cve.now/CVE-2026-55179.md): Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (CVSS 6.5)
- [CVE-2026-59816](https://cve.now/CVE-2026-59816.md): Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash (CVSS 4.3)
- [CVE-2026-49449](https://cve.now/CVE-2026-49449.md): Joplin: KaTeX \`trust:true\` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows (CVSS 2.5)
- [CVE-2026-49453](https://cve.now/CVE-2026-49453.md): Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory (CVSS 7.0)
- [CVE-2026-49450](https://cve.now/CVE-2026-49450.md): Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName (CVSS 7.1)
- [CVE-2026-34600](https://cve.now/CVE-2026-34600.md): Joplin Server delta API returns note content after share access is revoked (CVSS 5.7)
- [CVE-2025-57798](https://cve.now/CVE-2025-57798.md): Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input (CVSS 5.5)
- [CVE-2026-22810](https://cve.now/CVE-2026-22810.md): Joplin: Path traversal in OneNote importer allows overwriting arbitrary files (CVSS 8.2)
- [CVE-2025-27134](https://cve.now/CVE-2025-27134.md): Privilege escalation in Joplin server via user patch endpoint (CVSS 8.8)
- [CVE-2025-27409](https://cve.now/CVE-2025-27409.md): Joplin Server Vulnerable to Path Traversal (CVSS 7.5)
- [CVE-2025-25187](https://cve.now/CVE-2025-25187.md): Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin (CVSS 7.8)
- [CVE-2025-24028](https://cve.now/CVE-2025-24028.md): Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin (CVSS 7.8)
- [CVE-2024-55630](https://cve.now/CVE-2024-55630.md): DOM Clobbering leads to temporary DOS in the note viewer in Joplin (CVSS 3.3)
- [CVE-2024-53268](https://cve.now/CVE-2024-53268.md): Lack of validation on openExternal allows 1 click remote code execution in joplin (CVSS 7.3)
- [CVE-2024-49362](https://cve.now/CVE-2024-49362.md): Remote Code Execution on click of \<a\> Link in markdown preview (CVSS 7.7)
- [CVE-2024-40643](https://cve.now/CVE-2024-40643.md): Joplin has a parsing error leading to Cross-site Scripting (XSS) (CVSS 9.7)
- [CVE-2023-37898](https://cve.now/CVE-2023-37898.md): Safe mode Cross-site Scripting (XSS) vulnerability in Joplin (CVSS 8.2)
- [CVE-2023-38506](https://cve.now/CVE-2023-38506.md): Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin (CVSS 8.2)
- [CVE-2023-39517](https://cve.now/CVE-2023-39517.md): Cross site scripting (XSS) when clicking on an untrusted \`\<map\>\` link in Joplin (CVSS 8.2)
- [CVE-2023-45673](https://cve.now/CVE-2023-45673.md): Arbitrary code execution on click of PDF links in Joplin (CVSS 8.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/laurent22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.