https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:32:37.870485+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08136 bdu:2026-08136 2026-10-02T11:32:37.918630+00:00 bdu:2026-08136 https://cve.radiocsirt.org/vuln/euvd-2026-330945 EUVD-2026-330945 2026-10-02T11:32:37.918664+00:00 EUVD-2026-330945 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52884 fkie_cve-2026-52884 2026-10-02T11:32:37.918678+00:00

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1696 WID-SEC-W-2026-1696 — Notepad++: Schwachstelle ermöglicht Codeausführung 2026-10-02T11:32:37.918711+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Notepad++ ausnutzen, um beliebigen Programmcode auszuführen.