Vulnerability database

1 result

• Feb 12, 2026Notepad++ Download of Code Without Integrity Check VulnerabilityCVE-2025-15556 · Other software · Notepad++ · reported by VulnCheckExploitedHigh 7.7

  Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.

  Product

  Notepad++

  On CISA’s list since

  Feb 12, 2026 (federal fix deadline Mar 5, 2026)

  What to do

  Attackers are using this now. Install Notepad++’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.notepad-plus-plus.orggithub.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.