https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:38:15 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08136 bdu:2026-08136 https://cve.radiocsirt.org/vuln/bdu:2026-08136 https://cve.radiocsirt.org/vuln/euvd-2026-330945 EUVD-2026-330945 https://cve.radiocsirt.org/vuln/euvd-2026-330945 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52884 <p>Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.</p> <p>Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52884 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1696 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Notepad++ ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Notepad++ ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1696