https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-2110.htmlhttps://patchthecve.com/cve/CVE-2023-2110.htmlWed, 17 Jun 2026 05:51:25 +0000HIGH 8.2: Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, ohttps://patchthecve.com/cve/CVE-2023-33244.htmlhttps://patchthecve.com/cve/CVE-2023-33244.htmlWed, 17 Jun 2026 06:01:23 +0000HIGH 8.2: Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.https://patchthecve.com/cve/CVE-2023-24044.htmlhttps://patchthecve.com/cve/CVE-2023-24044.htmlWed, 17 Jun 2026 05:38:32 +0000MEDIUM 6.1: A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."https://patchthecve.com/cve/CVE-2022-45130.htmlhttps://patchthecve.com/cve/CVE-2022-45130.htmlWed, 17 Jun 2026 05:09:24 +0000MEDIUM 6.5: Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidihttps://patchthecve.com/cve/CVE-2022-36450.htmlhttps://patchthecve.com/cve/CVE-2022-36450.htmlWed, 17 Jun 2026 04:53:28 +0000HIGH 8.0: Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.