CVE-2026-59816: Improper Limitation of a Pathname to a Restricted Directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass t...

PT-2026-96247

Name of the Vulnerable Software and Affected Versions Joplin versions 1.4.0 through 3.7.1 Description In the packages/renderer/MdToHtml/rules/katex.ts file, the application enables the trust option for KaTeX note content. This allows an author to insert a href URL into the rendered output that...

CVE-2026-46650: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

PT-2026-96276

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description In the packages/renderer/MdToHtml/rules/fountain.ts file, HTML generated by the vendored fountain.js renderer is passed into the note output without sanitization. This...

CVE-2026-55105: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...

CVE-2026-94049: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function renderslides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be...

CVE-2025-39964 vulnerabilities

Vulnerabilities for packages: linux-desktop, linux-gcp, linux-qemu, linux-vmware, linux-qemu-melange, linux-aws, linux-raspberry-pi, linux-raspberry-pi-4, linux-azure, linux-firecracker...

CLEANSTART-2026-BZ49747 In Eclipse Vert

CVE-2026-15075 affects multiple packages. In Eclipse Vert. See references for individual vulnerability details...

CLEANSTART-2026-KP79659 Netty versions 4

CVE-2026-89044 affects multiple packages. Netty versions 4. See references for individual vulnerability details...

CLEANSTART-2026-ZS57953 authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

CVE-2026-66275 affects multiple packages. An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-BM99045 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-TE15990 Security fix for CVE-2021-21285 applied in: docker 20.10.3-r0, docker-fips 20.10.3-r0

CVE-2021-21285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UR94810 Security fix for CVE-2024-23650 applied in: docker 25.0.2-r0, docker-fips 25.0.2-r0

CVE-2024-23650 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XQ25414 Security fix for CVE-2024-23653 applied in: docker 25.0.2-r0, docker-fips 25.0.2-r0

CVE-2024-23653 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XQ75557 Security fix for CVE-2024-41110 applied in: docker 26.1.5-r0, docker-fips 26.1.5-r0, kubevela 1.10.8-r0, paranoia 0.2.1-r0, prometheus 2.47.2-r1, rancher-agent 2.11.15-r1

CVE-2024-41110 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YD16450 Security fix for CVE-2025-4674 applied in: cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, harbor-registry 3.0.0.1-r2, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.6.1-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-4674 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UY39386 Security fix for CVE-2023-5870 applied in: postgresql15 15.5-r0, postgresql16 16.1-r0, postgresql17 16.1-r0, postgresql18 16.1-r0

CVE-2023-5870 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH16511 Security fix for CVE-2025-46819 applied in: redis 7.2.11-r0, redis 7.4.6-r0, redis 8.0.4-r0, redis 8.2.2-r0

CVE-2025-46819 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HH85591 Security fix for CVE-2025-8714 applied in: postgresql16 16.10-r0, postgresql17 17.6-r0, postgresql18 17.6-r0

CVE-2025-8714 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ES01541 Security fix for CVE-2025-55190 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

CVE-2025-55190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...