Priority CRITICAL 93KEV
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.01746 · Published 2026-02-03 · Fixed in 8.8.9 CWE-494
Priority HIGH 72
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.00224 · Published 2026-09-22 · Fixed in 8.9.8 CWE-121
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00228 · Published 2026-09-22 · Fixed in 8.9.8 CWE-121
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00213 · Published 2026-09-22 · Fixed in 8.9.8 CWE-20
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00209 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-78
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0062 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-78
Priority HIGH 69
A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00168 · Published 2026-04-10 · Fixed in 8.9.4 CWE-121
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00517 · Published 2023-08-25 · No fix listed CWE-120
Priority HIGH 68
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00509 · Published 2026-08-17 · Fixed in 8.9.7 CWE-22
Priority HIGH 68
Notepad++ is a free and open-source source code editor.
CVSS 4.0HIGH 7.5· Local · No auth · No interaction · EPSS 0.00125 · Published 2026-06-26 · Fixed in 8.9.6.4 CWE-367
Priority HIGH 65
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00136 · Published 2026-09-22 · Fixed in 8.9.8 CWE-345
Priority MEDIUM 62
Notepad++ is a free and open-source source code editor.
CVSS 4.0MEDIUM 5.1· Local · Low privileges · User interaction · EPSS 0.00165 · Published 2026-08-17 · Fixed in 8.9.7 CWE-22
Priority MEDIUM 62
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0133 · Published 2023-01-19 · No fix listed CWE-787
Priority MEDIUM 60
Notepad++ is a free and open-source source code editor.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00121 · Published 2026-08-17 · Fixed in 8.9.7 CWE-345
Priority MEDIUM 58
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00162 · Published 2026-09-22 · Fixed in 8.9.8 CWE-476
Priority MEDIUM 58
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00414 · Published 2023-08-25 · No fix listed CWE-120
Priority MEDIUM 58
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00504 · Published 2023-08-25 · No fix listed CWE-120
Priority MEDIUM 58
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00524 · Published 2023-02-01 · No fix listed CWE-787
Priority MEDIUM 56
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.0· Local · Low privileges · User interaction · EPSS 0.00142 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-125
Priority MEDIUM 46
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.09832 · Published 2019-09-14 · No fix listed CWE-787
Priority LOW 37
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0075 · Published 2022-09-28 · No fix listed CWE-427
Priority LOW 35
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00194 · Published 2026-08-17 · Fixed in 8.9.7 CWE-121
Priority LOW 35
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00208 · Published 2026-06-26 · No fix listed CWE-42
Priority LOW 35
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00658 · Published 2025-06-23 · Fixed in 8.8.2 CWE-272
Priority LOW 35
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00535 · Published 2023-11-30 · No fix listed CWE-427
Load more
THREATIST.IORead the docs