hedgedoc vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20215
3. 20221
4. 20231
5. 20241
6. 20252
7. 20266

Newest CVEs

• CVE-2026-102927

  HedgeDoc: Missing validation of incoming permission values on change

  hedgedoc · hedgedoc

  Medium5.9
• CVE-2026-58489

  HedgeDoc: CSRF in GitHub Gist export callback

  hedgedoc · hedgedoc

  Medium6.8
• CVE-2026-58486

  HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

  hedgedoc · hedgedoc

  High8.3
• CVE-2026-58487

  HedgeDoc: Stored HTML injection via email local-part

  hedgedoc · hedgedoc

  Medium5.1
• CVE-2026-58488

  HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing

  hedgedoc · hedgedoc

  Medium6.9
• CVE-2026-25642

  HedgeDoc security headers for uploaded files were not working

  hedgedoc · hedgedoc

  Medium4.3
• CVE-2025-66629

  HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF

  hedgedoc · hedgedoc

  Low3.7
• CVE-2025-32391

  HedgeDoc allows XSS possibility through malicious SVG uploads

  hedgedoc · hedgedoc

  Medium6.4
• CVE-2024-45308

  MySQL & free URL mode allows to hide existing notes in hedgedoc

  hedgedoc · hedgedoc

  Medium6.5
• CVE-2023-38487

  HedgeDoc API allows to hide existing notes

  hedgedoc · hedgedoc

  Medium6.5