LE
Vendor
lepture
26
CVEs
0
On KEV
9
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115355 New | MI mistune lepture | 7.5 | Oct 22 | Mistune before 3.3.0 Path Traversal and XSS via Include Directive |
| CVE-2026-115354 New | MI mistune lepture | 6.5 | Oct 22 | Mistune before 3.3.0 Arbitrary Local File Read via Include Directive |
| CVE-2026-115353 New | MI mistune lepture | 8.6 | Oct 22 | Mistune before 3.3.0 Path Traversal via include Directive |
| CVE-2026-115352 New | MI mistune lepture | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser |
| CVE-2026-115351 New | MI mistune lepture | 4.7 | Oct 22 | Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option |
| CVE-2026-115350 New | MI mistune lepture | 6.1 | Oct 22 | Mistune before 3.3.0 Stored XSS via Include Directive HTML Files |
| CVE-2026-115349 New | MI mistune lepture | 7.5 | Oct 22 | Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing |
| CVE-2026-115348 New | MI mistune lepture | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text |
| CVE-2026-115347 New | MI mistune lepture | 7.5 | Oct 22 | Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text |
| CVE-2026-76098 | MI mistune lepture | 7.5 | Aug 24 | Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown |
| CVE-2026-59927 | MI mistune lepture | 5.3 | Jul 8 | Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files |
| CVE-2026-59928 | MI mistune lepture | 7.5 | Jul 8 | Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions |
| CVE-2026-59924 | MI mistune lepture | 5.9 | Jul 8 | Mistune: Arbitrary File Read via Include directive path traversal |
| CVE-2026-59929 | MI mistune lepture | 6.1 | Jul 8 | Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution |
| CVE-2026-59925 | MI mistune lepture | 7.5 | Jul 8 | inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs |
| CVE-2026-59926 | MI mistune lepture | 6.1 | Jul 8 | Mistune: XSS via unescaped class option in Admonition directive |
| CVE-2026-59923 | MI mistune lepture | 6.1 | Jul 8 | Mistune: XSS via percent-encoded javascript URI bypass in safe_url() |
| CVE-2026-59930 | MI mistune lepture | 4.3 | Jul 8 | Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content |
| CVE-2026-59922 | MI mistune lepture | 7.5 | Jul 8 | Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) |
| CVE-2026-49851 | MI mistune lepture | 7.5 | Jun 24 | Mistune: Potential DoS via quadratic-time parsing in parse_link_text |
| CVE-2026-44898 | MI mistune lepture | 6.1 | May 26 | Mistune TOC Anchor Injection XSS |
| CVE-2026-44897 | MI mistune lepture | 6.1 | May 26 | Mistune Heading ID Attribute Injection XSS |
| CVE-2026-44708 | MI mistune lepture | 6.1 | May 26 | Mistune Math Plugin XSS Escape Bypass |
| CVE-2026-44899 | MI mistune lepture | 6.1 | May 26 | Mistune Image Directive CSS Injection Vulnerability |
| CVE-2026-44896 | MI mistune lepture | 6.1 | May 26 | Mistune: XSS via unescaped figclass/figwidth in Figure directive |
| CVE-2026-33079 | MI mistune lepture | 7.5 | May 6 | Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles |