CVE-2021-37916

Joplin before 2.0.9 allows XSS via button and form in the note body.

• CWE-79

• https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26Patch, Third Party Advisory
• https://github.com/laurent22/joplin/releases/tag/v2.0.9Release Notes, Third Party Advisory
• https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26Patch, Third Party Advisory
• https://github.com/laurent22/joplin/releases/tag/v2.0.9Release Notes, Third Party Advisory

Published

Aug 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37910ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-…5.3
• CVE-2021-37911The management interface of BenQ smart wireless conference p…8.8
• CVE-2021-37912The HGiga OAKlouds mobile portal does not filter special cha…9.8
• CVE-2021-37913The HGiga OAKlouds mobile portal does not filter special cha…9.8
• CVE-2021-37914In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is …6.5
• CVE-2021-37915An issue was discovered on the Grandstream HT801 Analog Tele…8.8
• CVE-2021-37918Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37919Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-3792Some device communications in some Motorola-branded Binatone…5.3
• CVE-2021-37920Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37921Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37922Zoho ManageEngine ADManager Plus version 7110 and prior is v…5.3