NO
Product
Notepad++
by Notepad-plus-plus · last CVE Jun 26, 2026
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 8Low 0
Watch

Add Notepad++ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-15556
In wildKEV
7.5
2%
Feb 3
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
Affected: before 8.8.9
CVE-2026-48778
7.8
1%
Jun 26
Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter
Affected: before 8.9.6.1
CVE-2026-46710
7.8
0%
Jun 26
Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path
Affected: 8.9.4 before 8.9.6
CVE-2026-48800
7.8
0%
Jun 26
Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
Affected: before 8.9.6.1
CVE-2026-52884
7.8
0%
Jun 26
Notepad++: CVE-2026-48800 Bypass
Affected: 8.9.6.1
CVE-2026-5525
7.8
0%
Apr 10
Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS
Affected: 8.9.3
CVE-2023-47452
7.8
1%
Nov 30
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory
Affected: 6.5
CVE-2023-6401
7.8
0%
Nov 30
A vulnerability classified as problematic was found in NotePad++ up to 8.1
Affected: through 8.1
CVE-2023-40031
7.8
1%
Aug 25
Notepad++ is a free and open-source source code editor
Affected: through 8.5.6
CVE-2022-32168
7.8
1%
Sep 28
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the…
Affected: 8.3 before 8.4.5
CVE-2019-16294
7.8
10%
Sep 14
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file
Affected: before 7.7
CVE-2026-25926
7.3
0%
Feb 18
Notepad++ has an Untrusted Search Path
Affected: before 8.9.2
CVE-2022-31901
6.5
1%
Jan 19
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files
Affected: through 8.4.3
CVE-2026-52885
6.3
0%
Jun 26
Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
Affected: before 8.9.6.4
CVE-2023-40166
5.5
0%
Aug 25
Notepad++ is a free and open-source source code editor
Affected: through 8.5.6
CVE-2023-40164
5.5
1%
Aug 25
Notepad++ is a free and open-source source code editor
Affected: through 8.5.6
CVE-2023-40036
5.5
0%
Aug 25
Notepad++ is a free and open-source source code editor
Affected: through 8.5.6
CVE-2022-31902
5.5
1%
Feb 1
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add()
Affected: through 8.4.3
CVE-2026-48770
5.0
0%
Jun 26
Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
Affected: before 8.9.6.1
CVE-2026-6539
4.4
0%
Apr 30
Notepad++ 8.9.3 Format String Injection via nativeLang.xml
Affected: 8.9.3
Showing 20