Product by Open Source
Notepad++
15 known vulnerabilities in Notepad++ (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-57233 | Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction | 8.1 | |
| High | CVE-2026-48778 | Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter | 7.8 | |
| High | CVE-2026-85279 | Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value | 8.6 | |
| High | CVE-2026-86054 | Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path | 7.8 | |
| High | CVE-2026-77605 | Notepad++ Project Notepad-plus-plus: Improper Input Validation | 7.8 | |
| High | CVE-2026-85995 | Notepad++: Authenticode verification bypass allows modified updater execution | 7.3 | |
| High | CVE-2026-54758 | Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs | 7.8 | |
| Medium | CVE-2026-85288 | Notepad++ Project Notepad-plus-plus: OS Command Injection | 6.7 | |
| High | CVE-2026-48800 | Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection | 7.8 | |
| High | CVE-2026-52884 | Notepad++: CVE-2026-48800 Bypass | 7.8 | |
| High | CVE-2026-46710 | Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path | 7.8 | |
| High | CVE-2026-52885 | Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory | 6.3 | |
| Medium | CVE-2026-86056 | Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) | 5.5 | |
| Medium | CVE-2026-52886 | Notepad++: session.xml backupFilePath starts_with Bypass | — | |
| Medium | CVE-2026-48770 | Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash | 5.0 |