EUVD-2023-49963

Malicious code in bioql PyPI...

EUVD-2022-4507

Malicious code in bioql PyPI...

EUVD-2025-3599

Malicious code in bioql PyPI...

EUVD-2024-52828

Malicious code in bioql PyPI...

EUVD-2023-41769

Malicious code in bioql PyPI...

EUVD-2023-42308

Malicious code in bioql PyPI...

EUVD-2024-3261

Malicious code in bioql PyPI...

EUVD-2025-14844

Malicious code in bioql PyPI...

EUVD-2024-38554

Malicious code in bioql PyPI...

EUVD-2025-14838

Malicious code in bioql PyPI...

EUVD-2025-4077

Malicious code in bioql PyPI...

EUVD-2022-4621

Malicious code in bioql PyPI...

CVE-2023-37898

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. packages/renderer/MarkupToHtml.ts renders note content in safe mode by surrounding it with and , without escaping any...

CVE-2023-45673

Joplin is a free, open source note taking and to-do application. A remote code execution RCE vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code execution because Joplin...

CVE-2021-37916

Joplin before 2.0.9 allows XSS via button and form in the note body...

CVE-2025-27134

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id t...

CVE-2025-27134

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id t...

CVE-2025-27134

CVE-2025-27134 concerns Joplin server prior to version 3.3.3, where a vulnerability in the PATCH /api/users/:id endpoint allows a non-admin user to set the is_admin field to 1. This privilege escalation enables low-privilege users to perform administrative actions without proper authorization. Th...

CVE-2025-27409 Joplin Server Vulnerable to Path Traversal

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function i...

CVE-2024-55630

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property e.g. querySelector, that propert...