# laurent22 joplin.

Every CVE that names laurent22 joplin among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier](https://agentprime.io/advisories/CVE-2026-105786.md)
  `CVE-2026-105786` · CVE record: laurent22 joplin · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Broken access control
- [Joplin Server password reset accepts tokens issued for unrelated purposes](https://agentprime.io/advisories/CVE-2026-105785.md)
  `CVE-2026-105785` · CVE record: laurent22 joplin · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-620, CWE-640
- [Joplin whiteboard card rendering allows CSS injection into application chrome](https://agentprime.io/advisories/CVE-2026-105784.md)
  `CVE-2026-105784` · CVE record: laurent22 joplin · CVSS 4.6 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Joplin Web Clipper pairing allows cross-origin theft of a permanent API token](https://agentprime.io/advisories/CVE-2026-105783.md)
  `CVE-2026-105783` · CVE record: laurent22 joplin · CVSS 8.0 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl](https://agentprime.io/advisories/CVE-2026-46650.md)
  `CVE-2026-46650` · CVE record: laurent22 joplin · CVSS 4.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: Pending share recipients can write items into shared folders before accepting invitations](https://agentprime.io/advisories/CVE-2026-59815.md)
  `CVE-2026-59815` · CVE record: laurent22 joplin · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)](https://agentprime.io/advisories/CVE-2026-55210.md)
  `CVE-2026-55210` · CVE record: laurent22 joplin · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Joplin: Stored XSS via inline-served note attachment on published shares](https://agentprime.io/advisories/CVE-2026-59814.md)
  `CVE-2026-59814` · CVE record: laurent22 joplin · CVSS 7.6 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer](https://agentprime.io/advisories/CVE-2026-55105.md)
  `CVE-2026-55105` · CVE record: laurent22 joplin · CVSS 7.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint](https://agentprime.io/advisories/CVE-2026-46649.md)
  `CVE-2026-46649` · CVE record: laurent22 joplin · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID](https://agentprime.io/advisories/CVE-2026-55179.md)
  `CVE-2026-55179` · CVE record: laurent22 joplin · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash](https://agentprime.io/advisories/CVE-2026-59816.md)
  `CVE-2026-59816` · CVE record: laurent22 joplin · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal
- [Joplin: KaTeX \`trust:true\` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows](https://agentprime.io/advisories/CVE-2026-49449.md)
  `CVE-2026-49449` · CVE record: laurent22 joplin · CVSS 2.5 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-829
- [Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory](https://agentprime.io/advisories/CVE-2026-49453.md)
  `CVE-2026-49453` · CVE record: laurent22 joplin · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, CWE-20
- [Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName](https://agentprime.io/advisories/CVE-2026-49450.md)
  `CVE-2026-49450` · CVE record: laurent22 joplin · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-345, CWE-353, CWE-494
- [Joplin Server delta API returns note content after share access is revoked](https://agentprime.io/advisories/CVE-2026-34600.md)
  `CVE-2026-34600` · CVE record: laurent22 joplin · CVSS 5.7 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, Broken access control, CWE-281
- [Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input](https://agentprime.io/advisories/CVE-2025-57798.md)
  `CVE-2025-57798` · CVE record: laurent22 joplin · CVSS 5.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Denial of service
- [Privilege escalation in Joplin server via user patch endpoint](https://agentprime.io/advisories/CVE-2025-27134.md)
  `CVE-2025-27134` · CVE record: laurent22 joplin · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2025 · Tags: Broken access control
- [Joplin Server Vulnerable to Path Traversal](https://agentprime.io/advisories/CVE-2025-27409.md)
  `CVE-2025-27409` · CVE record: laurent22 joplin · CVSS 7.5 High · Not analysed yet · Published 30 Apr 2025 · Tags: Path traversal
- [Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin](https://agentprime.io/advisories/CVE-2025-25187.md)
  `CVE-2025-25187` · CVE record: laurent22 joplin · CVSS 7.8 High · Not analysed yet · Published 7 Feb 2025 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin](https://agentprime.io/advisories/CVE-2025-24028.md)
  `CVE-2025-24028` · CVE record: laurent22 joplin · CVSS 7.8 High · Not analysed yet · Published 7 Feb 2025 · Tags: Cross-site scripting (XSS)
- [DOM Clobbering leads to temporary DOS in the note viewer in Joplin](https://agentprime.io/advisories/CVE-2024-55630.md)
  `CVE-2024-55630` · CVE record: laurent22 joplin · CVSS 3.3 Low · Not analysed yet · Published 7 Feb 2025 · Tags: CWE-20
- [Lack of validation on openExternal allows 1 click remote code execution in joplin](https://agentprime.io/advisories/CVE-2024-53268.md)
  `CVE-2024-53268` · CVE record: laurent22 joplin · CVSS 7.3 High · Not analysed yet · Published 25 Nov 2024 · Tags: Code injection
- [Joplin has a parsing error leading to Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2024-40643.md)
  `CVE-2024-40643` · CVE record: laurent22 joplin · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2024 · Tags: Cross-site scripting (XSS)
- [Safe mode Cross-site Scripting (XSS) vulnerability in Joplin](https://agentprime.io/advisories/CVE-2023-37898.md)
  `CVE-2023-37898` · CVE record: laurent22 joplin · CVSS 8.2 High · Not analysed yet · Published 21 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin](https://agentprime.io/advisories/CVE-2023-38506.md)
  `CVE-2023-38506` · CVE record: laurent22 joplin · CVSS 8.2 High · Not analysed yet · Published 21 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Cross site scripting (XSS) when clicking on an untrusted \`\<map>\` link in Joplin](https://agentprime.io/advisories/CVE-2023-39517.md)
  `CVE-2023-39517` · CVE record: laurent22 joplin · CVSS 8.2 High · Not analysed yet · Published 21 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Arbitrary code execution on click of PDF links in Joplin](https://agentprime.io/advisories/CVE-2023-45673.md)
  `CVE-2023-45673` · CVE record: laurent22 joplin · CVSS 8.9 High · Not analysed yet · Published 21 Jun 2024 · Tags: Code injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=laurent22-joplin>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/laurent22-joplin/>. Everything for agents: <https://agentprime.io/llms.txt>.