NO
Product
notepad-plus-plus
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
8.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 14Medium 10Low 0
Watch
Add notepad-plus-plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85288 | 6.7 | Sep 22 | Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog Affected: < 8.9.8 |
| CVE-2026-52885 | 6.3 | Jun 26 | Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory Affected: < 8.9.6.4 |
| CVE-2026-86056 | 5.5 | Sep 22 | Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) Affected: < 8.9.8 |
| CVE-2023-40166 | 5.5 | Aug 25 | Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining Affected: <= 8.5.6 |
| CVE-2023-40164 | 5.5 | Aug 25 | Notepad++ global buffer read overflow in nsCodingStateMachine::NextState Affected: <= 8.5.6 |
| CVE-2023-40036 | 5.5 | Aug 25 | Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar Affected: <= 8.5.6 |
| CVE-2026-71858 | 5.4 | Aug 17 | Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution Affected: < 8.9.7 |
| CVE-2026-73250 | 5.4 | Aug 11 | Notepad++: Install-time PowerShell command injection through installation path Affected: < 8.9.7 |
| CVE-2026-52886 | 5.1 | Aug 17 | Notepad++: session.xml backupFilePath starts_with Bypass Affected: < 8.9.7 |
| CVE-2026-48770 | 5.0 | Jun 26 | Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash Affected: < 8.9.6.1 |
Showing 10
