https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 12:20:17 +0000 https://db.gcve.eu/vuln/cve-2026-46649 <p><strong>Affected:</strong> laurent22 joplin</p> <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server&#39;s GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user&#39;s notes, notebooks, and account settings. This issue is fixed in version 3.7.2.</p> <p><strong>Affected:</strong> laurent22 joplin</p> <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server&#39;s GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user&#39;s notes, notebooks, and account settings. This issue is fixed in version 3.7.2.</p> https://db.gcve.eu/vuln/cve-2026-46649