Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Oct 13, 2026VNote is a note-taking platform.CVE-2026-86022 · Other software · vnotex · reported by GitHubHigh 7
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026VNote is a note-taking platform.CVE-2026-86016 · Other software · vnotex · reported by GitHubHigh 8.2
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A weakness has been identified in vnotex vnote up to 3.20.1.CVE-2026-15505 · Other software · vnotex · reported by VulDBLow 2
A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component YAML Frontmatter. This manipulation of the argument p_metaData causes cross site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024VNote is a note-taking platform.CVE-2024-41662 · Other software · vnotex · reported by GitHubHigh 8.6
VNote is a note-taking platform. A Cross-Site Scripting (XSS) vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and prior of the VNote note-taking application. This vulnerability allows the injection and execution of arbitrary JavaScript code through which remote code execution can be achieved. A patch for this issue is available at commit f1af78573a0ef51d6ef6a0bc4080cddc8f30a545. Other mitigation strategies include implementing rigorous input sanitization for all Markdown content and utilizing a secure Markdown parser that appropriately escapes or strips potentially dangerous content.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024VNote is a note-taking platform.CVE-2024-39904 · Other software · vnotex · reported by GitHubHigh 8.8
VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic.CVE-2023-5701 · Other software · vnotex · reported by VulDBMedium 4.3
A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019VNote 2.2 has XSS via a new text note.CVE-2019-8419 · Other software · Vnote Project · reported by MITREMedium 6.1
VNote 2.2 has XSS via a new text note.
- Product
- Vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.