laurent22 vulnerabilities

CVEs per yearBy the year they were published

1. 20247
2. 20255
3. 202618

Newest CVEs

• CVE-2026-105786

  Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

  laurent22 · joplin

  High8.5
• CVE-2026-105785

  Joplin Server password reset accepts tokens issued for unrelated purposes

  laurent22 · joplin

  Medium4.8
• CVE-2026-105784

  Joplin whiteboard card rendering allows CSS injection into application chrome

  laurent22 · joplin

  Medium4.6
• CVE-2026-105783

  Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

  laurent22 · joplin

  High8.0
• CVE-2026-46650

  Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

  laurent22 · joplin

  Medium4.4
• CVE-2026-59815

  Joplin: Pending share recipients can write items into shared folders before accepting invitations

  laurent22 · joplin

  Medium4.3
• CVE-2026-55210

  Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)

  laurent22 · joplin

  High7.4
• CVE-2026-59814

  Joplin: Stored XSS via inline-served note attachment on published shares

  laurent22 · joplin

  High7.6
• CVE-2026-55105

  Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer

  laurent22 · joplin

  High7.7
• CVE-2026-46649

  Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

  laurent22 · joplin

  Critical9.1