Known vulnerabilities in Joplin Desktop

Vendor: Joplinapp
Software CPE: cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:*:*:*
Total vulnerabilities: 19
Public exploits: 5
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Joplin Desktop Joplin Desktop is affected by 19 known vulnerabilities: 1 high, 5 medium, 13 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU103728 - Improper input validation
CVE-2024-55630
CWE-20 Low
Available
No
3.2.8 10.02.2025 SB2025021020
#VU103727 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-24028
CWE-79 Low
Available
No
3.2.12 10.02.2025 SB2025021016
#VU103726 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-25187
CWE-79 Low
Available
No
3.1.24 10.02.2025 SB2025021015
#VU131601 - Improper input validation
CVE-2024-53268
CWE-20 Medium
No
No
3.0.3 25.11.2024 SB2024112553
#VU131600 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-49362
CWE-79 Medium
No
No
3.1.1 14.11.2024 SB2024111462
#VU97767 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-40643
CWE-79 Low
No
No
3.0.15 30.09.2024 SB2024093021
#VU131596 - Improper input validation
CVE-2023-45673
CWE-20 High
No
No
2.13.3 21.06.2024 SB20240621123
#VU131597 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-39517
CWE-79 Medium
No
No
2.12.8 21.06.2024 SB20240621122
#VU131598 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-38506
CWE-79 Medium
No
No
2.12.10 21.06.2024 SB20240621121
#VU131599 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-37898
CWE-79 Medium
No
No
2.12.9 21.06.2024 SB20240621120
#VU77732 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.11.11 27.06.2023 SB2023062716
#VU76391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.11.3 19.05.2023 SB2023051953
#VU59686 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.7.6 18.01.2022 SB2022011808
#VU55867 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-37916
CWE-79 Low
No
No
2.0.9 16.08.2021 SB2021081613
#VU53057 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-15930
CWE-79 Low
Available
No
1.1.4 11.05.2021 SB2020092416
#VU53056 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-28249
CWE-79 Low
Available
No
1.2.6 11.05.2021 SB2020110618
#VU53055 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.8.5 11.05.2021 SB2021051102
#VU25839 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.0.193 09.03.2020 SB2020030915
#VU31279 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-1000534
CWE-79 Low
No
No
1.0.90 26.06.2018 SB2018062617