Skip to content
OpenAdvisories

Vendor

laurent22

30 known vulnerabilities.

Products

joplin 30
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-46649

    Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without app…

    laurent22 joplin
  • Critical 9.7
    CVE-2024-40643

    Joplin has a parsing error leading to Cross-site Scripting (XSS)

    Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.

    laurent22 joplin