Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-86056 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-86054 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-85995 · Other software · notepad-plus-plus · reported by GitHubHigh 7.3
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, but the issue does not provide remote code execution by itself. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-85288 · Other software · notepad-plus-plus · reported by GitHubMedium 6.7
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-85279 · Other software · notepad-plus-plus · reported by GitHubHigh 8.6
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Notepad++ is a free and open-source source code editor.CVE-2026-77605 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can execute the sibling script as the current user instead of opening the selected file. This issue is fixed in version 8.9.8.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Notepad++ is a free and open-source source code editor.CVE-2026-71858 · Other software · notepad-plus-plus · reported by GitHubMedium 5.4
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++ process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Notepad++ is a free and open-source source code editor.CVE-2026-57233 · Other software · notepad-plus-plus · reported by GitHubHigh 8.1
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Notepad++ is a free and open-source source code editor.CVE-2026-54758 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Notepad++ is a free and open-source source code editor.CVE-2026-52886 · Other software · notepad-plus-plus · reported by GitHubMedium 5.1
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Notepad++ is a free and open-source source code editor.CVE-2026-73250 · Other software · notepad-plus-plus · reported by GitHubMedium 5.4
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-52885 · Other software · notepad-plus-plus · reported by GitHubHigh 7.5
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-Check). However, the command payload is taken from the in-memory _userCommands vector, which is populated at application startup and never re-synchronized with the on-disk file (Time-of-Use). Swapping shortcuts.xml between startup and command execution causes the HMAC check to validate a clean file while a malicious command runs. An attacker with write access to shortcuts.xml places a malicious version on disk before launch, then immediately restores the legitimate file. The HMAC check at execution time validates the restored legitimate file (check passes), while the malicious payload executes from memory. This vulnerability is fixed in 8.9.6.4.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-52884 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-48800 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-48778 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-48770 · Other software · notepad-plus-plus · reported by GitHubMedium 5
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Notepad++ is a free and open-source source code editor.CVE-2026-46710 · Other software · notepad-plus-plus · reported by GitHubHigh 7.5
Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writable custom installation directory, and a privileged user later runs the installer and selects that directory, the attacker-controlled executable is launched with the elevated privileges of the installer. This vulnerability is fixed in 8.9.6.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Notepad++ is a free and open-source source code editor.CVE-2026-25926 · Other software · notepad-plus-plus · reported by GitHubHigh 7.3
Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Notepad++ is a free and open-source source code editor.CVE-2025-49144 · Other software · notepad-plus-plus · reported by GitHubHigh 7.3
Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Nov 30, 2023An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working direCVE-2023-47452 · Other software · Notepad-plus-plus · reported by MITREHigh 7.8
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability classified as problematic was found in NotePad++ up to 8.1.CVE-2023-6401 · Other software · Notepad-plus-plus · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40166 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40164 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40036 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40031 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Jan 31, 2023Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().CVE-2022-31902 · Other software · Notepad-plus-plus · reported by MITREMedium 5.5
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.CVE-2022-31901 · Other software · Notepad-plus-plus · reported by MITREMedium 6.5
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbiCVE-2022-32168 · Other software · notepad-plus-plus · reported by vulnerabilitylab@mend.ioHigh 7.8
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2019SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.CVE-2019-16294 · Other software · Notepad-plus-plus · reported by MITREHigh 7.8
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.