High
CVE-2026-76098
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filters
High
CVE-2026-49851
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
High
CVE-2026-33079
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59926
Mistune: XSS via unescaped class option in Admonition directive
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path traversal
High
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Medium
CVE-2026-44899
Mistune Image Directive CSS Injection Vulnerability
Medium
CVE-2026-44898
Mistune TOC Anchor Injection XSS
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
Medium
CVE-2026-44896
Mistune has XSS via unescaped figclass/figwidth in Figure directive
Medium
CVE-2026-44708
Mistune Math Plugin has an XSS Escape Bypass
High
CVE-2022-34749
Mistune vulnerable to catastrophic backtracking
Medium
CVE-2019-1020019
Cross-site Scripting in invenio-previewer
Medium
CVE-2017-16876
mistune Cross-site scripting (XSS) vulnerability
Medium
CVE-2017-15612
Cross-site Scripting in Mistune
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.