CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-67422

CVE-2026-67422 affects pymdown-extensions up to version 11.0, where four inline processors—caret, tilde, betterem, and magiclink—use regex patterns whose groups can partition delimiter runs in exponentially many ways. This causes catastrophic backtracking and unbounded CPU usage when rendering a ...

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

PT-2026-68813

Name of the Vulnerable Software and Affected Versions league/commonmark versions 0.6.0 through 2.8.3 Description Specially crafted Markdown lines can cause the parser to exhibit quadratic time complexity during conversion. This occurs because several parsing paths repeatedly rescan growing portio...

CVE-2026-61632: Improper Limitation of a Pathname to a Restricted Directory

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

CLSA-2026-1774225205 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.1...

CLSA-2026-1774225206 TuxCare security update for markdown-it (2 CVEs)

TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 8.4.2-tuxcare.1...

CLSA-2026-1773620215 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.0.3-tuxcare.1...

CLSA-2026-1773015255 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

CVE-2026-69089

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-69089 Grav CMS before 2.0.11 Path Traversal via watermark

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

The vulnerability affects Markdown preview extensions in enhanced code editors such as Visual Studio Code, Pulsar, and Atom. This allows attackers to execute arbitrary code.

The vulnerability of Markdown extension Preview Enhanced code editors like Visual Studio Code, Pulsar, and Atom is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

SUSE CVE-2026-4054

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header e.g. image/png...

SUSE CVE-2026-6339

Mattermost versions 11.5.x = 11.5.1, 11.4.x = 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost...

SUSE CVE-2026-35600

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags,...

SUSE CVE-2026-54070

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...

CVE-2026-48910

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...