https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-42090.htmlhttps://patchthecve.com/cve/CVE-2026-42090.htmlMon, 26 Oct 2026 19:10:00 +0000CRITICAL 9.6: Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version 3.3.20, a stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app. The root cause is thhttps://patchthecve.com/cve/CVE-2026-33978.htmlhttps://patchthecve.com/cve/CVE-2026-33978.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and then rendered with innerHTML inside the mobilehttps://patchthecve.com/cve/CVE-2026-33976.htmlhttps://patchthecve.com/cve/CVE-2026-33976.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.6: Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source p