# cve.now: Lepture

The newest entries naming Lepture as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121438](https://cve.now/CVE-2026-121438.md): Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing (CVSS 6.9)
- [CVE-2026-121437](https://cve.now/CVE-2026-121437.md): Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via \_process\_emphasis\_delimiters (CVSS 8.7)
- [CVE-2026-115355](https://cve.now/CVE-2026-115355.md): Mistune before 3.3.0 Path Traversal and XSS via Include Directive (CVSS 8.7)
- [CVE-2026-115354](https://cve.now/CVE-2026-115354.md): Mistune before 3.3.0 Arbitrary Local File Read via Include Directive (CVSS 7.1)
- [CVE-2026-115353](https://cve.now/CVE-2026-115353.md): Mistune before 3.3.0 Path Traversal via include Directive (CVSS 9.2)
- [CVE-2026-115352](https://cve.now/CVE-2026-115352.md): Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser (CVSS 8.7)
- [CVE-2026-115351](https://cve.now/CVE-2026-115351.md): Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option (CVSS 5.3)
- [CVE-2026-115350](https://cve.now/CVE-2026-115350.md): Mistune before 3.3.0 Stored XSS via Include Directive HTML Files (CVSS 5.3)
- [CVE-2026-115349](https://cve.now/CVE-2026-115349.md): Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing (CVSS 8.7)
- [CVE-2026-115348](https://cve.now/CVE-2026-115348.md): Mistune before 3.3.0 Quadratic-Time DoS via parse\_link\_text (CVSS 8.7)
- [CVE-2026-115347](https://cve.now/CVE-2026-115347.md): Mistune before 3.3.0 Quadratic Denial of Service via parse\_link\_text (CVSS 8.7)
- [CVE-2026-76098](https://cve.now/CVE-2026-76098.md): Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown (CVSS 7.5)
- [CVE-2026-59927](https://cve.now/CVE-2026-59927.md): Mistune directives/include: mutual \`.. include::\` recursion crashes the renderer with \`RecursionError\`, denial of service via two attacker-controlled markdown files (CVSS 5.3)
- [CVE-2026-59928](https://cve.now/CVE-2026-59928.md): Mistune block\_parser: quadratic-time parsing on long lists of repeated reference-link definitions (CVSS 7.5)
- [CVE-2026-59924](https://cve.now/CVE-2026-59924.md): Mistune: Arbitrary File Read via Include directive path traversal (CVSS 5.9)
- [CVE-2026-59929](https://cve.now/CVE-2026-59929.md): Mistune renderers/html.safe\_url: HARMFUL\_PROTOCOLS list misses legacy and chained schemes that historically chain to \`javascript:\` execution (CVSS 6.1)
- [CVE-2026-59925](https://cve.now/CVE-2026-59925.md): inline\_parser: quadratic-time parsing on long runs of \`\*\*x\*\*\` and \`\*\*\*x\*\*\*\` emphasis pairs (CVSS 7.5)
- [CVE-2026-59926](https://cve.now/CVE-2026-59926.md): Mistune: XSS via unescaped class option in Admonition directive (CVSS 5.3)
- [CVE-2026-59923](https://cve.now/CVE-2026-59923.md): Mistune: XSS via percent-encoded javascript URI bypass in safe\_url() (CVSS 6.1)
- [CVE-2026-59930](https://cve.now/CVE-2026-59930.md): Mistune toc / TableOfContents directive: heading IDs use predictable \`toc\_N\` numbering with no slugification, allowing collision with attacker-controlled \`id="toc\_N"\` content (CVSS 4.3)
- [CVE-2026-59922](https://cve.now/CVE-2026-59922.md): Mistune plugins/formatting: quadratic-time parsing on long runs of \`~~x~~\`, \`==x==\`, and \`^^x^^\` markers (strikethrough / mark / insert) (CVSS 7.5)
- [CVE-2026-49851](https://cve.now/CVE-2026-49851.md): Mistune: Potential DoS via quadratic-time parsing in parse\_link\_text (CVSS 8.7)
- [CVE-2026-44898](https://cve.now/CVE-2026-44898.md): Mistune TOC Anchor Injection XSS (CVSS 6.1)
- [CVE-2026-44897](https://cve.now/CVE-2026-44897.md): Mistune Heading ID Attribute Injection XSS (CVSS 6.1)
- [CVE-2026-44708](https://cve.now/CVE-2026-44708.md): Mistune Math Plugin XSS Escape Bypass (CVSS 6.1)
- [CVE-2026-44899](https://cve.now/CVE-2026-44899.md): Mistune Image Directive CSS Injection Vulnerability (CVSS 4.7)
- [CVE-2026-44896](https://cve.now/CVE-2026-44896.md): Mistune: XSS via unescaped figclass/figwidth in Figure directive (CVSS 5.3)
- [CVE-2026-33079](https://cve.now/CVE-2026-33079.md): Mistune ReDoS in LINK\_TITLE\_RE allows denial of service with crafted Markdown titles (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/lepture
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.