MI
Product
mistune
26
CVEs
0
On KEV
8.6
Max CVSS
9
New 30D
Severity mix
Critical 0High 12Medium 14Low 0
Watch
Add mistune to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115353 New | 8.6 | Oct 22 | Mistune before 3.3.0 Path Traversal via include Directive Affected: before 3.3.0 |
| CVE-2026-115355 New | 7.5 | Oct 22 | Mistune before 3.3.0 Path Traversal and XSS via Include Directive Affected: before 3.3.0 |
| CVE-2026-115352 New | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser Affected: before 3.3.0 |
| CVE-2026-115349 New | 7.5 | Oct 22 | Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing Affected: 3.0.0 before 3.3.0 |
| CVE-2026-115348 New | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text Affected: 3.0.0 before 3.3.0 |
| CVE-2026-115347 New | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text Affected: before 3.3.0 |
| CVE-2026-76098 | 7.5 | Aug 24 | Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown Affected: >= 3.3.0, < 3.3.3 |
| CVE-2026-59928 | 7.5 | Jul 8 | Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions Affected: < 3.3.0 |
| CVE-2026-59925 | 7.5 | Jul 8 | inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs Affected: < 3.3.0 |
| CVE-2026-59922 | 7.5 | Jul 8 | Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) Affected: < 3.3.0 |
| CVE-2026-49851 | 7.5 | Jun 24 | Mistune: Potential DoS via quadratic-time parsing in parse_link_text Affected: < 3.3.0 |
| CVE-2026-33079 | 7.5 | May 6 | Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles Affected: >=3.0.0a1, <= 3.2.0 |
Showing 12