{"uuid": "2bc7144f-a81f-47bb-8587-9cfccf8624fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46649", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117417718754891227", "content": "CVE-2026-46649: Joplin Server pre-3.7.2 SSO code endpoint skips brute-force limits, letting unauthenticated attackers guess 9-digit codes and steal session tokens for full note access. CVSS 9.1. Patch under review - restrict https://www.valtersit.com/cve/CVE-2026-46649/ #CVE #infosec #Joplin", "creation_timestamp": "2026-10-10T17:10:04.146040Z"}