CVE-2026-109597

A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting XSS vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML an...

CVE-2026-111759

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes...

OSCP-Exam-Report-Template-Markdown

Offensive Security Exam Report Template in Markdown I created an Offensive Security Exam Report Template in Markdown so LaTeX, Microsoft Office Word, LibreOffice Writer are no longer needed during your Offensive Security OSCP, OSWE, OSEE, OSWP, OSEP, OSED, OSWA, OSDA, OSMR, OSTH, OSIR exam! Now y...

CVE-2022-45025

CVE-2022-45025 Command injection via PDF import in Markdown Preview Enhanced VSCode, Atom Description The Mume markdown tool library was vulnerable to command injection due to use of spawn command with shell: true option. This could allow an attacker to achieve arbitary code execution by tricking...

CVE-2026-111759 markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes...

CVE-2026-111759

The markdown-it Markdown parser is vulnerable to a denial of service (DoS) due to quadratic processing time in its smartquotes rule. When the typographer: true option is enabled, specially crafted Markdown containing many opening double quotes followed by unmatched closing single quotes (or vice ...

EUVD-2026-104538

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes...

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML via innerHTML with no sanitization,...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

GHSA-VX2M-GPQ4-8J5Q LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad Remote Code Execution RCE Security Research & Technical Analysis Repository ⚠️ This repository is intended for educational, defensive, and research purposes only. 📖 Overview CVE-2026-20841 is a critical Remote Code Execution RCE vulnerability affecting Microsoft...

CVE-2026-102941

A flaw was found in github.com/gomarkdown/markdown. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Markdown content containing empty or very short link destinations. When link sanitization is enabled, the parser attempts to read beyond the boundaries of the...

CVE-2024-41662

CVE-2024-41662 Markdown XSS leads to RCE in VNote version NOTE: The application properly validates some JavaScript payloads by performing output encoding in the app. However, it fails to validate in certain cases. 5. Further an attacker can achieve Remote Code execution using the following payloa...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

CVE-2024-44337

CVE-2024-44337 The package "github.com/gomarkdown/markdown" is a Go library for parsing Markdown text and rendering it as HTML. In pseudo-version 'v0.0.0-20240729232818-a2a9c4f' corresponding to commit 'a2a9c4f76ef5a5c32108e36f7c47f8d310322252' and earlier, there is a logic issue in the paragraph...

engagement-mgr

Engagement Manager Engagement Manager is a web application for tracking offensive security engagements. It features a modern UI, built with Next.js, Prisma, and PostgreSQL. The app includes a calendar, engagements, clients, contacts, findings, and operators. Lee Baird @discoverscripts Jay...