https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-29281.htmlhttps://patchthecve.com/cve/CVE-2022-29281.htmlWed, 17 Jun 2026 04:39:58 +0000HIGH 8.8: Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program (or theft of NTLM credentials via an SMB relay attack, bechttps://patchthecve.com/cve/CVE-2022-26198.htmlhttps://patchthecve.com/cve/CVE-2022-26198.htmlWed, 17 Jun 2026 04:34:49 +0000CRITICAL 9.8: Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.https://patchthecve.com/cve/CVE-2020-16608.htmlhttps://patchthecve.com/cve/CVE-2020-16608.htmlWed, 17 Jun 2026 02:58:04 +0000CRITICAL 9.6: Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).