NS
Product
Notes Station 3
10
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 3Medium 6Low 0
Watch
Add Notes Station 3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34007 | 6.9 | Oct 15 | **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()` Affected: 3.9.x before 3.9.11 |
| CVE-2024-38645 | 6.5 | Nov 22 | Notes Station 3 Affected: 3.9.x before 3.9.7 |
| CVE-2024-38646 | 6.0 | Nov 22 | Notes Station 3 Affected: 3.9.x before 3.9.7 |
| CVE-2024-27126 | 5.4 | Sep 6 | Notes Station 3 Affected: 3.9.x before 3.9.6 |
| CVE-2024-27122 | 5.4 | Sep 6 | Notes Station 3 Affected: 3.9.x before 3.9.6 |
| CVE-2026-39991 | 4.8 | Oct 15 | Stored Cross-Site Scripting (XSS) in Note Station file upload functionality Affected: 3.9.x before 3.9.12 |
Showing 6