Known vulnerabilities in HedgeDoc 1.6.0

Vendor: HedgeDoc
Software: HedgeDoc
Version: 1.6.0
Software CPE: cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*
Website: https://hedgedoc.org/
Total vulnerabilities: 17
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting HedgeDoc version 1.6.0 HedgeDoc 1.6.0 is affected by 17 vulnerabilities: 1 high, 9 medium, 7 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127927 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25642		 CWE-79 Medium
No
No
 1.10.6 25.04.2026 SB20260425211
#VU127926 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.10.6 25.04.2026 SB20260425211
#VU127925 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 1.10.4 25.04.2026 SB20260425210
#VU127924 - Cross-Site Request Forgery (CSRF)
CVE-2025-66629		 CWE-352 Low
No
No
 1.10.4 25.04.2026 SB20260425210
#VU127923 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32391		 CWE-79 Low
No
No
 1.10.3 10.04.2025 SB2025041049
#VU127922 - Improper Validation of Syntactic Correctness of Input
 CWE-1286 Medium
No
No
 1.10.2 14.02.2025 SB2025021482
#VU127920 - Information Exposure Through an Error Message
 CWE-209 Medium
No
No
 1.10.1 02.02.2025 SB2025020202
#VU127921 - Improper Restriction of Excessive Authentication Attempts
 CWE-307 Medium
No
No
 1.10.1 02.02.2025 SB2025020202
#VU127919 - Improper Validation of Unsafe Equivalence in Input
CVE-2024-45308		 CWE-1289 Medium
No
No
 1.10.0 01.09.2024 SB2024090101
#VU56235 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-39175		 CWE-79 Low
No
No
 1.9.0 01.09.2021 SB2021090112
SB2021091406
#VU53185 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.8.2 12.05.2021 SB2021051220
#VU53184 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-29503		 CWE-79 Low
No
No
 1.8.2 12.05.2021 SB2021051220
SB2021051926
#VU52831 - Resource exhaustion
CVE-2021-21306		 CWE-400 Medium
No
No
 1.8.0 04.05.2021 SB2021020815
SB2021050404
#VU52830 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-29474		 CWE-22 Medium
No
No
 1.8.0 04.05.2021 SB2021050402
#VU127918 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-21259		 CWE-79 Medium
No
No
 1.7.2 15.01.2021 SB2021011551
#VU49233 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-26287		 CWE-79 Low
No
No
 1.7.1 29.12.2020 SB2021010408
#VU49234 - Unrestricted Upload of File with Dangerous Type
CVE-2020-26286		 CWE-434 High
No
No
 1.7.1 29.12.2020 SB2021010408