CVE Tools
Track your stack

Notepad-plus-plus

4 CVEs tracked since 2023. Since Aug 2023, none of them reached CISA KEV.

Notepad-plus-plus CVEs per month

Aug 2023 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Notepad-plus-plus CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-0840
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-108 or fewer

Products

The products that kept showing up in Notepad-plus-plus's monthly top three, with their CVEs summed over those months.

  1. Notepad-plus-plus41 month
  2. Notepad\+\+41 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Notepad-plus-plus.

  1. CVE-2026-85995Notepad++: Authenticode verification bypass allows modified updater execution7.3
  2. CVE-2026-86056Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)5.5
  3. CVE-2026-77605Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)7.8
  4. CVE-2026-86054Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path7.8
  5. CVE-2026-85288Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog6.7
  6. CVE-2026-85279Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value8.6
  7. CVE-2026-57233Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction8.1
  8. CVE-2026-52886Notepad++: session.xml backupFilePath starts_with Bypass—
  9. CVE-2026-71858Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution—
  10. CVE-2026-54758Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs7.8
  11. CVE-2026-73250Notepad++: Install-time PowerShell command injection through installation path—
  12. CVE-2026-48770Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash5.0
  13. CVE-2026-48778Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter7.8
  14. CVE-2026-52885Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory6.3
  15. CVE-2026-46710Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path7.8

The record

Peak rank
#197 in Aug 2023
Busiest month shown
Aug 2023, 4 CVEs
Months with a KEV entry
0 since Aug 2023
Monthly snapshots
1 since 2023
Notepad-plus-plus's full record, month by month