CVE-2026-58489 | | | 2026-07-13 | HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value bu… |
CVE-2026-58486 | | | 2026-07-13 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to… |
CVE-2026-58488 | | | 2026-07-13 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of… |
CVE-2026-58487 | | | 2026-07-13 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of register… |
CVE-2026-25642 | Medium | 4.3 | 2026-02-06 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more… |
CVE-2025-66629 | Low | 3.7 | 2025-12-05 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login provide… |
CVE-2025-32391 | Medium | 6.4 | 2025-04-10 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the pos… |
CVE-2024-45308 | Medium | 6.5 | 2024-09-02 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes w… |
CVE-2023-38487 | Medium | 6.5 | 2023-08-04 | HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an ali… |
CVE-2022-24837 | Medium | 5.3 | 2022-04-11 | HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable fil… |
CVE-2021-39175 | High | 8.1 | 2021-08-30 | HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-no… |
CVE-2021-29503 | High | 8.1 | 2021-05-19 | HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a n… |
CVE-2021-29474 | Medium | 4.7 | 2021-04-26 | HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the server's filesystem du… |
CVE-2021-29475 | Critical | 10.0 | 2021-04-26 | HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when e… |
CVE-2021-21259 | High | 7.4 | 2021-01-22 | HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitra… |
CVE-2020-26287 | High | 8.7 | 2020-12-29 | HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in Hedge… |
CVE-2020-26286 | High | 7.5 | 2020-12-29 | HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files… |