lepture mistune

• CVE-2026-121438 Medium 5.3 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing 0.3%
• CVE-2026-121437 High 7.5 Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters 0.6%
• CVE-2026-115355 High 7.5 Mistune before 3.3.0 Path Traversal and XSS via Include Directive 0.5%
• CVE-2026-115354 Medium 6.5 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive 0.5%
• CVE-2026-115353 High 8.6 Mistune before 3.3.0 Path Traversal via include Directive 0.4%
• CVE-2026-115352 High 7.5 Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser 0.4%
• CVE-2026-115351 Medium 4.7 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option 0.2%
• CVE-2026-115350 Medium 6.1 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files 0.2%
• CVE-2026-115349 High 7.5 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing 0.3%
• CVE-2026-115348 High 7.5 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text 0.4%
• CVE-2026-115347 High 7.5 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text 0.4%
• CVE-2026-76098 High 7.5 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown 0.5%
• CVE-2026-59927 Medium 5.3 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files 0.5%
• CVE-2026-59928 High 7.5 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions 0.7%
• CVE-2026-59924 Medium 5.9 Mistune: Arbitrary File Read via Include directive path traversal 0.5%
• CVE-2026-59929 Medium 6.1 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution 0.3%
• CVE-2026-59925 High 7.5 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs 0.6%
• CVE-2026-59926 Medium 5.3 Mistune: XSS via unescaped class option in Admonition directive 0.3%
• CVE-2026-59923 Medium 6.1 Mistune: XSS via percent-encoded javascript URI bypass in safe_url() 0.3%
• CVE-2026-59930 Medium 4.3 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content 0.2%
• CVE-2026-59922 High 7.5 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) 0.6%
• CVE-2026-49851 High 7.5 Mistune: Potential DoS via quadratic-time parsing in parse_link_text 0.5%
• CVE-2026-44898 Medium 6.1 Mistune TOC Anchor Injection XSS 0.2%
• CVE-2026-44897 Medium 6.1 Mistune Heading ID Attribute Injection XSS 0.2%
• CVE-2026-44708 Medium 6.1 Mistune Math Plugin XSS Escape Bypass 0.2%
• CVE-2026-44899 Medium 4.7 Mistune Image Directive CSS Injection Vulnerability 0.2%
• CVE-2026-44896 Medium 5.3 Mistune: XSS via unescaped figclass/figwidth in Figure directive 0.2%
• CVE-2026-33079 High 7.5 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles 0.6%