agentprime: laurent22-joplinEvery new CVE for laurent22-joplin.https://agentprime.io/CVE-2026-105786: Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifierhttps://agentprime.io/advisories/CVE-2026-105786/https://agentprime.io/advisories/CVE-2026-105786/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:18:27 GMTCVECVE-2026-105785: Joplin Server password reset accepts tokens issued for unrelated purposeshttps://agentprime.io/advisories/CVE-2026-105785/https://agentprime.io/advisories/CVE-2026-105785/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:12:45 GMTCVECVE-2026-105784: Joplin whiteboard card rendering allows CSS injection into application chromehttps://agentprime.io/advisories/CVE-2026-105784/https://agentprime.io/advisories/CVE-2026-105784/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:11:35 GMTCVECVE-2026-105783: Joplin Web Clipper pairing allows cross-origin theft of a permanent API tokenhttps://agentprime.io/advisories/CVE-2026-105783/https://agentprime.io/advisories/CVE-2026-105783/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:10:26 GMTCVECVE-2026-46650: Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrlhttps://agentprime.io/advisories/CVE-2026-46650/https://agentprime.io/advisories/CVE-2026-46650/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:16:12 GMTCVECVE-2026-59815: Joplin: Pending share recipients can write items into shared folders before accepting invitationshttps://agentprime.io/advisories/CVE-2026-59815/https://agentprime.io/advisories/CVE-2026-59815/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:15:15 GMTCVECVE-2026-55210: Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)https://agentprime.io/advisories/CVE-2026-55210/https://agentprime.io/advisories/CVE-2026-55210/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:14:31 GMTCVECVE-2026-59814: Joplin: Stored XSS via inline-served note attachment on published shareshttps://agentprime.io/advisories/CVE-2026-59814/https://agentprime.io/advisories/CVE-2026-59814/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:13:17 GMTCVECVE-2026-55105: Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewerhttps://agentprime.io/advisories/CVE-2026-55105/https://agentprime.io/advisories/CVE-2026-55105/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:59:52 GMTCVECVE-2026-46649: Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpointhttps://agentprime.io/advisories/CVE-2026-46649/https://agentprime.io/advisories/CVE-2026-46649/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:58:04 GMTCVEcriticalCVE-2026-55179: Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server IDhttps://agentprime.io/advisories/CVE-2026-55179/https://agentprime.io/advisories/CVE-2026-55179/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:56:31 GMTCVECVE-2026-59816: Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slashhttps://agentprime.io/advisories/CVE-2026-59816/https://agentprime.io/advisories/CVE-2026-59816/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:54:39 GMTCVECVE-2026-49449: Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windowshttps://agentprime.io/advisories/CVE-2026-49449/https://agentprime.io/advisories/CVE-2026-49449/CVSS 2.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:52:11 GMTCVECVE-2026-49453: Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directoryhttps://agentprime.io/advisories/CVE-2026-49453/https://agentprime.io/advisories/CVE-2026-49453/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:50:28 GMTCVECVE-2026-49450: Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherNamehttps://agentprime.io/advisories/CVE-2026-49450/https://agentprime.io/advisories/CVE-2026-49450/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:49:04 GMTCVECVE-2026-34600: Joplin Server delta API returns note content after share access is revokedhttps://agentprime.io/advisories/CVE-2026-34600/https://agentprime.io/advisories/CVE-2026-34600/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 22:28:28 GMTCVECVE-2025-57798: Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Inputhttps://agentprime.io/advisories/CVE-2025-57798/https://agentprime.io/advisories/CVE-2025-57798/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 20:24:35 GMTCVECVE-2025-27134: Privilege escalation in Joplin server via user patch endpointhttps://agentprime.io/advisories/CVE-2025-27134/https://agentprime.io/advisories/CVE-2025-27134/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Apr 2025 14:55:10 GMTCVECVE-2025-27409: Joplin Server Vulnerable to Path Traversalhttps://agentprime.io/advisories/CVE-2025-27409/https://agentprime.io/advisories/CVE-2025-27409/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Apr 2025 14:55:07 GMTCVECVE-2025-25187: Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplinhttps://agentprime.io/advisories/CVE-2025-25187/https://agentprime.io/advisories/CVE-2025-25187/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Feb 2025 22:38:20 GMTCVECVE-2025-24028: Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplinhttps://agentprime.io/advisories/CVE-2025-24028/https://agentprime.io/advisories/CVE-2025-24028/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Feb 2025 22:23:07 GMTCVECVE-2024-55630: DOM Clobbering leads to temporary DOS in the note viewer in Joplinhttps://agentprime.io/advisories/CVE-2024-55630/https://agentprime.io/advisories/CVE-2024-55630/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Feb 2025 22:23:04 GMTCVECVE-2024-53268: Lack of validation on openExternal allows 1 click remote code execution in joplinhttps://agentprime.io/advisories/CVE-2024-53268/https://agentprime.io/advisories/CVE-2024-53268/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 25 Nov 2024 19:22:17 GMTCVECVE-2024-40643: Joplin has a parsing error leading to Cross-site Scripting (XSS)https://agentprime.io/advisories/CVE-2024-40643/https://agentprime.io/advisories/CVE-2024-40643/CVSS 9.7 (Critical). Critical: CVSS score 9.7: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Sep 2024 14:28:20 GMTCVEcriticalCVE-2023-37898: Safe mode Cross-site Scripting (XSS) vulnerability in Joplinhttps://agentprime.io/advisories/CVE-2023-37898/https://agentprime.io/advisories/CVE-2023-37898/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Jun 2024 19:45:19 GMTCVECVE-2023-38506: Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplinhttps://agentprime.io/advisories/CVE-2023-38506/https://agentprime.io/advisories/CVE-2023-38506/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Jun 2024 19:43:24 GMTCVECVE-2023-39517: Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplinhttps://agentprime.io/advisories/CVE-2023-39517/https://agentprime.io/advisories/CVE-2023-39517/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Jun 2024 19:41:48 GMTCVECVE-2023-45673: Arbitrary code execution on click of PDF links in Joplinhttps://agentprime.io/advisories/CVE-2023-45673/https://agentprime.io/advisories/CVE-2023-45673/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Jun 2024 19:38:22 GMTCVE