CVE-2026-46650Proof of concept (PoC) published · CISA
Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
CVSS score
4.4
EPSS probability
%0.3
Risk score
0.0
Published
24 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-46649
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
L
Patch status unknownEPSS %1
7.7
CVE-2026-55105
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
L
Patch status unknownEPSS %0
7.4
CVE-2026-55210
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
L
Patch status unknownEPSS %0
7.0
CVE-2026-49453
Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
L
Patch status unknownEPSS %0
7.6
CVE-2026-59814
Joplin: Stored XSS via inline-served note attachment on published shares
L
Patch status unknownEPSS %0
8.5
CVE-2026-105786
Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
L
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-46650"