Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Sep 7, 2026Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaSCVE-2026-78325 · Other software · Standard Notes · reported by b2fa7fcc-7d08-41f0-853b-11242c5539dbMedium 6.9
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
- Product
- Standard Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability.CVE-2025-12489 · Other software · evernote-mcp-server · reported by zdi-disclosures@trendmicro.comHigh 7.8
evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913.
- Product
- evernote-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Sep 4, 2025The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing.CVE-2025-6984 · Other software · langchain-ai · reported by security@huntr.devHigh 7.5
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.
- Product
- langchain-ai/langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024Evernote Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54422 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.This issue affects Evernote Sync: from n/a through <= 3.0.0.
- Product
- Evernote Sync
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Evernote Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2024An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments componeCVE-2023-50643 · Other software · Evernote · reported by MITRECritical 9.8
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comelectronjs.org
Jun 24, 2021An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler.CVE-2020-17759 · Other software · Evernote · reported by MITREHigh 8.8
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevernote.comevernote.com
Mar 2, 2020The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.CVE-2018-19658 · Other software · Evernote · reported by MITREMedium 5.4
The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote.
- Product
- Yinxiang Biji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyinxiang.comyinxiang.com
Jan 31, 2020Evernote prior to 5.5.1 has insecure password changeCVE-2013-5116 · Other software · Evernote · reported by MITREHigh 7.1
Evernote prior to 5.5.1 has insecure password change
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.compacketstormsecurity.com
Jan 31, 2020Evernote before 5.5.1 has insecure PIN storageCVE-2013-5112 · Other software · Evernote · reported by MITREMedium 4.6
Evernote before 5.5.1 has insecure PIN storage
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.c22.ccexchange.xforce.ibmcloud.com
Sep 30, 2019Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-cliCVE-2019-17051 · Other software · Evernote · reported by MITREHigh 7.8
Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevernote.comyoutube.com
Jun 18, 2019A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary weCVE-2019-12592 · Other software · Evernote · reported by MITREMedium 6.1
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.
- Product
- Web Clipper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberscoop.comtechrepublic.com
May 31, 2019Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.apCVE-2019-10038 · Other software · Evernote · reported by MITREHigh 7.8
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comevernote.com
May 13, 2019Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.CVE-2018-18524 · Other software · Evernote · reported by MITREMedium 6.1
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevernote.compaper.seebug.org
Dec 21, 2018The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.CVE-2018-20351 · Other software · Evernote · reported by MITREMedium 6.1
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyinxiang.comyinxiang.com
Dec 11, 2018In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.CVE-2018-20058 · Other software · Evernote · reported by MITREHigh 7.5
In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevernote.comevernote.com
Aug 30, 2018The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.CVE-2018-14901 · Other software · Epson · reported by MITREHigh 7.5
The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
- Product
- Iprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvdalabs.comvdalabs.com
May 22, 2017Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecCVE-2016-4900 · Other software · Evernote · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Evernote for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvndb.jvn.jpsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.