hedgedoc

Products

Exploited and recent CVEs

• CVE-2026-102927 Medium 5.9 HedgeDoc: Missing validation of incoming permission values on change 0.3%
• CVE-2026-58489 Medium 6.8 HedgeDoc: CSRF in GitHub Gist export callback 0.2%
• CVE-2026-58486 High 8.3 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter 0.4%
• CVE-2026-58487 Medium 5.1 HedgeDoc: Stored HTML injection via email local-part 0.5%
• CVE-2026-58488 Medium 6.9 HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing 0.4%
• CVE-2026-25642 Medium 4.3 HedgeDoc security headers for uploaded files were not working 0.2%
• CVE-2025-66629 Low 3.7 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF 0.1%
• CVE-2025-32391 Medium 6.4 HedgeDoc allows XSS possibility through malicious SVG uploads 0.3%
• CVE-2024-45308 Medium 6.5 MySQL & free URL mode allows to hide existing notes in hedgedoc 0.6%
• CVE-2023-38487 Medium 6.5 HedgeDoc API allows to hide existing notes 0.8%
• CVE-2022-24837 Medium 5.3 Enumerable upload file names in hedgedoc 1.1%
• CVE-2021-39175 High 8.1 XSS vector in slide mode speaker-view 0.6%
• CVE-2021-29503 High 8.1 Improper Neutralization of Script-Related HTML Tags in Notes 1.0%
• CVE-2021-29474 Medium 4.7 Relative Path Traversal Attack on note creation 1.6%
• CVE-2021-29475 Critical 10.0 PDF export allows arbitrary file reads 1.2%
• CVE-2021-21259 High 7.4 Stored XSS in slide mode 1.4%
• CVE-2020-26287 High 8.7 Stored XSS in mermaid diagrams 1.5%
• CVE-2020-26286 High 7.5 Arbitary file upload 1.4%