MAL-2025-37952 Malicious code in ursa-global-passport-markdown-pdf (npm)

The package ursa-global-passport-markdown-pdf was found to contain malicious code...

MAL-2025-24314 Malicious code in kardashevscale-markdown-pdf-cressida-fetch (npm)

The package kardashevscale-markdown-pdf-cressida-fetch was found to contain malicious code...

MAL-2025-33587 Malicious code in sociobiology-markdown-arcturus-xenon (npm)

The package sociobiology-markdown-arcturus-xenon was found to contain malicious code...

MAL-2025-25943 Malicious code in markdown-pdf-fermiparadox-eigenstate-quark (npm)

The package markdown-pdf-fermiparadox-eigenstate-quark was found to contain malicious code...

MAL-2025-17738 Malicious code in cryptography-markdown-neutronstar-configstore (npm)

The package cryptography-markdown-neutronstar-configstore was found to contain malicious code...

MAL-2025-38447 Malicious code in virgo-astro-express-markdown-pdf (npm)

The package virgo-astro-express-markdown-pdf was found to contain malicious code...

MAL-2025-39658 Malicious code in xenon-markdown-pdf-backend-playwright (npm)

The package xenon-markdown-pdf-backend-playwright was found to contain malicious code...

MAL-2025-27748 Malicious code in nova-carina-prettier-plugin-markdown-triton (npm)

The package nova-carina-prettier-plugin-markdown-triton was found to contain malicious code...

MAL-2025-17419 Malicious code in commitlint-equinox-markdown-pdf-draco (npm)

The package commitlint-equinox-markdown-pdf-draco was found to contain malicious code...

MAL-2025-25939 Malicious code in markdown-izar-blazar-halley (npm)

The package markdown-izar-blazar-halley was found to contain malicious code...

Cross-site Scripting (XSS)

Apache JSPWiki is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient sanitization of wiki markup and markdown header link creation because specially crafted input can execute JavaScript in the victim’s browser, enabling theft of sensitive information...

GitLab 13.2 < 18.0.6 / 18.1 < 18.1.4 / 18.2 < 18.2.2 (CVE-2025-2937)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial o...

CVE-2025-55161

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

CVE-2025-2937

An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature...

CVE-2025-2937

Removed by vendor...

CVE-2025-2937

GitLab CE/EE vulnerability CVE-2025-2937 affects all versions 13.2–18.0.5, 18.1.x before 18.1.4, and 18.2.x before 18.2.2. Authenticated users may trigger a denial of service by sending specially crafted markdown payloads to the Wiki feature. No remediation details are provided in the supplied do...

CVE-2025-2937

An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature...

CVE-2025-2937 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature...

CVE-2025-51691

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...

CVE-2025-51691

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...