https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:01:05.427029+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-238752 EUVD-2026-238752 2026-10-04T11:01:05.501390+00:00 EUVD-2026-238752 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25849 fkie_cve-2022-25849 2026-10-04T11:01:05.501427+00:00

The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well.

 https://cve.radiocsirt.org/vuln/ghsa-4r9g-w48q-8jwm GHSA-4r9g-w48q-8jwm — HyperDown vulnerable to Cross-site Scripting 2026-10-04T11:01:05.501458+00:00

Affected: Packagist: joyqi/hyper-down

HyperDown is a markdown parser written for the Chinese website SegmentFault. Improper validation of the href attribute allows for Cross-site Scripting. At publication there are no patched versions, and no known workarounds.

 https://cve.radiocsirt.org/vuln/gsd-2022-25849 gsd-2022-25849 2026-10-04T11:01:05.501483+00:00 gsd-2022-25849