NO
Product
Notepad++
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 8Low 0
Watch
Add Notepad++ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-15556 In wildKEV | 7.5 | Feb 3 | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification Affected: before 8.8.9 |
| CVE-2026-48778 | 7.8 | Jun 26 | Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter Affected: before 8.9.6.1 |
| CVE-2026-46710 | 7.8 | Jun 26 | Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path Affected: 8.9.4 before 8.9.6 |
| CVE-2026-48800 | 7.8 | Jun 26 | Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection Affected: before 8.9.6.1 |
| CVE-2026-52884 | 7.8 | Jun 26 | Notepad++: CVE-2026-48800 Bypass Affected: 8.9.6.1 |
| CVE-2026-5525 | 7.8 | Apr 10 | Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS Affected: 8.9.3 |
| CVE-2023-47452 | 7.8 | Nov 30 | An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory Affected: 6.5 |
| CVE-2023-6401 | 7.8 | Nov 30 | A vulnerability classified as problematic was found in NotePad++ up to 8.1 Affected: through 8.1 |
| CVE-2023-40031 | 7.8 | Aug 25 | Notepad++ is a free and open-source source code editor Affected: through 8.5.6 |
| CVE-2022-32168 | 7.8 | Sep 28 | Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the… Affected: 8.3 before 8.4.5 |
| CVE-2019-16294 | 7.8 | Sep 14 | SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file Affected: before 7.7 |
| CVE-2026-25926 | 7.3 | Feb 18 | Notepad++ has an Untrusted Search Path Affected: before 8.9.2 |
| CVE-2022-31901 | 6.5 | Jan 19 | Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files Affected: through 8.4.3 |
| CVE-2026-52885 | 6.3 | Jun 26 | Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory Affected: before 8.9.6.4 |
| CVE-2023-40166 | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor Affected: through 8.5.6 |
| CVE-2023-40164 | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor Affected: through 8.5.6 |
| CVE-2023-40036 | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor Affected: through 8.5.6 |
| CVE-2022-31902 | 5.5 | Feb 1 | Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add() Affected: through 8.4.3 |
| CVE-2026-48770 | 5.0 | Jun 26 | Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash Affected: before 8.9.6.1 |
| CVE-2026-6539 | 4.4 | Apr 30 | Notepad++ 8.9.3 Format String Injection via nativeLang.xml Affected: 8.9.3 |
Showing 20
