Latest vulnerabilities for vendor "mistune project"

Where

Sort:

Software

mistune project mistune

Mistune MistuneMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Risk 27

Severity

5.3

First published (updated )

CVE-2026-59927

Mistune MistuneMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59928

Mistune MistuneMistune: Arbitrary File Read via Include directive path traversal

Risk 35

Severity

5.9

First published (updated )

CVE-2026-59924

Mistune MistuneMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Risk 38

Severity

6.1

First published (updated )

CVE-2026-59929

Mistune Mistuneinline_parser: quadratic-time parsing on long runs of `x` and `x` emphasis pairs

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59925

Mistune MistuneMistune: XSS via unescaped class option in Admonition directive

Risk 38

Severity

5.3

First published (updated )

CVE-2026-59926

Mistune MistuneMistune: XSS via percent-encoded javascript URI bypass in safe_url()

Risk 38

Severity

6.1

First published (updated )

CVE-2026-59923

Mistune MistuneMistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Risk 22

Severity

4.3

First published (updated )

CVE-2026-59930

Mistune MistuneMistune plugins/formatting: quadratic-time parsing on long runs of `x`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59922

pip/mistuneMistune Image Directive CSS Injection Vulnerability

Risk 38

Severity

6.1

First published (updated )

CVE-2026-44899

pip/mistuneMistune TOC Anchor Injection XSS

Risk 38

Severity

6.1

First published (updated )

CVE-2026-44898

pip/mistuneMistune Heading ID Attribute Injection XSS

Risk 38

Severity

6.1

First published (updated )

CVE-2026-44897

pip/mistuneMistune: XSS via unescaped figclass/figwidth in Figure directive

Risk 38

Severity

5.3

First published (updated )

CVE-2026-44896

pip/mistuneMistune Math Plugin XSS Escape Bypass

Risk 38

Severity

6.1

First published (updated )

CVE-2026-44708

IBM Watson Studio on Cloud Pak for DataIn mistune through 2.0.2, support of inline markup is implemented by using regular expressions that …

Risk 68

Severity

8.6

First published (updated )

CVE-2022-34749

pip/mistuneXSS

Risk 39

Severity

6.1

First published (updated )

CVE-2017-16876

pip/mistuneXSS

Risk 38

Severity

6.1

First published (updated )

CVE-2017-15612

Trending

Vendor Risk Score

Software

Mistune MistuneMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune MistuneMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune MistuneMistune: Arbitrary File Read via Include directive path traversal

Mistune MistuneMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune Mistuneinline_parser: quadratic-time parsing on long runs of `x` and `x` emphasis pairs

Don't miss critical vulnerabilities

Mistune MistuneMistune: XSS via unescaped class option in Admonition directive

Mistune MistuneMistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune MistuneMistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune MistuneMistune plugins/formatting: quadratic-time parsing on long runs of `x`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

pip/mistuneMistune Image Directive CSS Injection Vulnerability

Don't miss critical vulnerabilities

pip/mistuneMistune TOC Anchor Injection XSS

pip/mistuneMistune Heading ID Attribute Injection XSS

pip/mistuneMistune: XSS via unescaped figclass/figwidth in Figure directive

pip/mistuneMistune Math Plugin XSS Escape Bypass

IBM Watson Studio on Cloud Pak for DataIn mistune through 2.0.2, support of inline markup is implemented by using regular expressions that …

Don't miss critical vulnerabilities

pip/mistuneXSS

pip/mistuneXSS

Company

Resources

Contact

Trending

Vendor Risk Score

Software

Mistune MistuneMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune MistuneMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune MistuneMistune: Arbitrary File Read via Include directive path traversal

Mistune MistuneMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune Mistuneinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Don't miss critical vulnerabilities

Mistune MistuneMistune: XSS via unescaped class option in Admonition directive

Mistune MistuneMistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune MistuneMistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune MistuneMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

pip/mistuneMistune Image Directive CSS Injection Vulnerability

Don't miss critical vulnerabilities

pip/mistuneMistune TOC Anchor Injection XSS

pip/mistuneMistune Heading ID Attribute Injection XSS

pip/mistuneMistune: XSS via unescaped figclass/figwidth in Figure directive

pip/mistuneMistune Math Plugin XSS Escape Bypass

IBM Watson Studio on Cloud Pak for DataIn mistune through 2.0.2, support of inline markup is implemented by using regular expressions that …

Don't miss critical vulnerabilities

pip/mistuneXSS

pip/mistuneXSS

Company

Resources

Contact

Mistune Mistuneinline_parser: quadratic-time parsing on long runs of `x` and `x` emphasis pairs

Mistune MistuneMistune plugins/formatting: quadratic-time parsing on long runs of `x`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)