NO
Vendor
Notepad-plus-plus
39
CVEs
2
On KEV
0
New 30D
Products
NO7.8
Notepad++
Notepad-plus-plus
20 CVEs1 on KEV0 new
NO8.6
notepad-plus-plus
notepad-plus-plus
19 CVEs1 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85995 | NO notepad-plus-plus notepad-plus-plus | 7.3 | Sep 22 | Notepad++: Authenticode verification bypass allows modified updater execution |
| CVE-2026-86056 | NO notepad-plus-plus notepad-plus-plus | 5.5 | Sep 22 | Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) |
| CVE-2026-77605 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Sep 22 | Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution) |
| CVE-2026-86054 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Sep 22 | Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path |
| CVE-2026-85288 | NO notepad-plus-plus notepad-plus-plus | 6.7 | Sep 22 | Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog |
| CVE-2026-85279 | NO notepad-plus-plus notepad-plus-plus | 8.6 | Sep 22 | Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value |
| CVE-2026-57233 | NO notepad-plus-plus notepad-plus-plus | 8.1 | Aug 17 | Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction |
| CVE-2026-52886 | NO notepad-plus-plus notepad-plus-plus | 5.1 | Aug 17 | Notepad++: session.xml backupFilePath starts_with Bypass |
| CVE-2026-71858 | NO notepad-plus-plus notepad-plus-plus | 5.4 | Aug 17 | Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution |
| CVE-2026-54758 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Aug 17 | Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs |
| CVE-2026-73250 | NO notepad-plus-plus notepad-plus-plus | 5.4 | Aug 11 | Notepad++: Install-time PowerShell command injection through installation path |
| CVE-2026-48770 | NO notepad-plus-plus notepad-plus-plus | 5.0 | Jun 26 | Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash |
| CVE-2026-48778 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Jun 26 | Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter |
| CVE-2026-52885 | NO notepad-plus-plus notepad-plus-plus | 6.3 | Jun 26 | Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory |
| CVE-2026-46710 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Jun 26 | Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path |
| CVE-2026-48800 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Jun 26 | Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection |
| CVE-2026-52884 | NO notepad-plus-plus notepad-plus-plus | 7.8 | Jun 26 | Notepad++: CVE-2026-48800 Bypass |
| CVE-2026-6539 | NO Notepad++ Notepad-plus-plus | 4.4 | Apr 30 | Notepad++ 8.9.3 Format String Injection via nativeLang.xml |
| CVE-2026-5525 | NO Notepad++ Notepad-plus-plus | 7.8 | Apr 10 | Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS |
| CVE-2026-25926 | NO notepad-plus-plus notepad-plus-plus | 7.3 | Feb 18 | Notepad++ has an Untrusted Search Path |
| CVE-2025-15556 In wildKEV | NO notepad-plus-plus notepad-plus-plus | 7.5 | Feb 3 | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification |
| CVE-2023-47452 | NO Notepad++ Notepad-plus-plus | 7.8 | Nov 30 | An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory |
| CVE-2023-6401 | NO Notepad++ Notepad-plus-plus | 7.8 | Nov 30 | A vulnerability classified as problematic was found in NotePad++ up to 8.1 |
| CVE-2023-40166 | NO Notepad++ Notepad-plus-plus | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor |
| CVE-2023-40164 | NO Notepad++ Notepad-plus-plus | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor |
| CVE-2023-40036 | NO Notepad++ Notepad-plus-plus | 5.5 | Aug 25 | Notepad++ is a free and open-source source code editor |
| CVE-2023-40031 | NO Notepad++ Notepad-plus-plus | 7.8 | Aug 25 | Notepad++ is a free and open-source source code editor |
| CVE-2022-31902 | NO Notepad++ Notepad-plus-plus | 5.5 | Feb 1 | Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add() |
| CVE-2022-31901 | NO Notepad++ Notepad-plus-plus | 6.5 | Jan 19 | Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files |
| CVE-2022-32168 | NO Notepad++ Notepad-plus-plus | 7.8 | Sep 28 | Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the… |
| CVE-2019-16294 | NO Notepad++ Notepad-plus-plus | 7.8 | Sep 14 | SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file |