Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 10:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

209-65% vs 7-day avg of 596

2 critical, 81 high, 83 medium, 33 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.7	CVE-2026-115355	Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115355Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths Executive summary The Mistune Markdown parser, before version 3.3.0, has a flaw that lets attackers read arbitrary files on the server. The advisory also says it can enable cross-site scripting, and it rates the issue high severity with a CVSS score of 8.7. Technical summary The flaw is a path traversal (CWE-22) in the Include directive, where ../ sequences in include paths let an attacker read arbitrary files. The CVSS v4 vector given is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, which indicates network attack with no privileges or user interaction and high confidentiality impact. The advisory also states that unescaped error messages and included file contents allow XSS even when escape=True is set. The fixed version is stated as 3.3.0, and the affected range is listed as mistune >= 0, < 3.3.0. No workarounds, detection guidance, or exploitation-in-the-wild information is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from vulncheck.com/advisories/mistune-before…ia-include-directive Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Critical	9.2	CVE-2026-115353	Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115353Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths Executive summary Mistune, a Python Markdown renderer, contains a path traversal flaw in its RST include directive that lets an attacker read arbitrary files on the server that the rendering process can access. The advisory rates it High with a CVSS base score of 8.6, and the fix is to upgrade to version 3.3.0 or later. Technical summary The flaw is a path traversal (CWE-22 and CWE-73) in the include directive plugin, where the directive argument is joined to the source directory without containment checks, so absolute paths or ../ sequences read any file the process can open. The attacker needs only to submit markdown to an application that renders it with the Include directive enabled and state.env['__file__'] set; no authentication or user interaction is stated, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. With escape=False, including an attacker-supplied .html file can also yield stored XSS. Affected versions are stated as 3.2.1 and earlier (<= 3.2.1), with the patched version 3.3.0. The advisory suggests a realpath and commonpath containment check, but it does not state a workaround other than that fix, and no detection guidance or evidence of in-the-wild exploitation is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lepture/mistune/security/adv…/GHSA-9jjx-3hq3-hx4j Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	8.7	CVE-2026-115352	Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of... lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115352Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of... Executive summary The advisory says the Mistune Python Markdown library, versions 3.2.1 and earlier, can be made to use excessive CPU by a small crafted Markdown input, causing a denial of service for any service that renders untrusted Markdown. It rates the issue High with a CVSS 3.1 base score of 7.5, and the fix is to upgrade to version 3.3.0. Technical summary This is an algorithmic complexity denial of service in the inline link parser, where long runs of unmatched '[' characters cause quadratic time parsing, tied to CWE-407 and CWE-1333. The attack is network-reachable and needs no authentication or user interaction, using a small Markdown payload such as about 16 KB of '[' characters, which the advisory says takes over 30 seconds to process. Affected versions are stated as <= 3.2.1 and the patched version is 3.3.0. The advisory describes two possible workarounds (capping tracked open brackets or a delimiter-stack rewrite), but these are suggested fixes rather than stated workarounds for deployed systems, and no detection guidance is stated. No CVE ID is listed (the advisory says 'No known CVE'), and no evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lepture/mistune/security/adv…/GHSA-xrpv-r66x-8p7j Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115351	Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the... lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115351Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the... Executive summary The mistune Python Markdown library, versions from 3.2.1 up to but not including 3.3.0, contains a CSS injection flaw in its Figure directive. The advisory rates it Moderate severity, and the vendor's recommended fix is to upgrade to version 3.3.0. Technical summary The flaw is CSS injection (CWE-94 and CWE-1287) in the figwidth option of the Figure directive, which is concatenated unvalidated into a style attribute of the rendered figure tag. An attacker who can supply markdown input can add CSS declarations, such as a url() background that triggers outbound requests for data exfiltration. The advisory's CVSS v3 base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, and it states that the affected versions are 5 3.2.1 and below, with 3.3.0 as the patched version. The advisory describes a suggested code fix that applies the existing length regex to figwidth, but it does not state a workaround for users who cannot upgrade. Whether exploitation in the wild has occurred is not stated, and no CVE ID is listed in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lepture/mistune/security/adv…/GHSA-xmwc-wjpr-q378 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115350	Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115350Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens Executive summary The Mistune Python Markdown library, versions up to and including 3.2.1, can be made to output unescaped HTML from an included file when the Include directive is used with escape=False. An attacker who can place a crafted .html file where the rendering process can read it could cause cross-site scripting in pages that render their Markdown. The advisory rates the severity as moderate (CVSS 3.1 base score 6.1), and the fix is to upgrade to version 3.3.0. Technical summary The flaw is cross-site scripting (CWE-79, with CWE-95 also listed) caused by the Include directive returning .html, .xhtml, and .htm file contents as raw block_html tokens, which the HTML renderer passes through unescaped when escape=False. Exploitation requires the application to use escape=False with the Include directive enabled, and an attacker who can write a .html file to a path the rendering process can read, then reference it from attacker-controlled Markdown; the advisory notes the path-traversal issue in the Include directive makes this easier. Affected versions are stated as less than or equal to 3.2.1, and the patched version is 3.3.0. The advisory describes a suggested code change that emits included HTML as a code block instead, and recommends pairing it with path containment; no workaround beyond that and the upgrade is explicitly stated. The advisory does not state whether exploitation has been observed in the wild, and no detection guidance is given beyond the proof of concept. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lepture/mistune/security/adv…/GHSA-96vr-jm8v-g22j Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	8.7	CVE-2026-115348	Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to... lepture, Mistunelepture mistune, Mistune	NVD	Oct 22 19:17 UTC
CVE-2026-115348Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to... Executive summary A flaw in the mistune Markdown library for Python lets an unauthenticated attacker send a short string of unbalanced square brackets that makes rendering consume large amounts of CPU, which can tie up a server worker for a long time. The advisory rates it High, with a proposed CVSS 3.1 score of 7.5 that the maintainer has not yet confirmed. The advisory shows the issue in version 3.2.1 and the fix is to upgrade to version 3.3.0, which the advisory lists as the patched version. Technical summary This is an algorithmic complexity flaw (CWE-1333, leading to CWE-400) in the inline link parser's parse_link_text function, where an input of many unmatched opening brackets causes quadratic-time scanning. The attack vector is network, requires no privileges or user interaction, and only needs the attacker to supply Markdown that the application renders; the advisory says the default configuration and escape=True safe mode are both affected. Affected versions are listed as >= 3.0.0 and <= 3.2.1, with the patched version 3.3.0. The advisory describes a fix that bounds the fallback scan, but it does not state a workaround for users who cannot upgrade. Detection guidance is not stated, and no CVE identifier is given in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lepture/mistune/security/adv…/GHSA-x2gr-6qf2-fc9x Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects lepture Mistune lepture mistune Mistune NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee