https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25642.htmlhttps://patchthecve.com/cve/CVE-2026-25642.htmlWed, 17 Jun 2026 10:25:00 +0000MEDIUM 4.3: HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interachttps://patchthecve.com/cve/CVE-2025-66629.htmlhttps://patchthecve.com/cve/CVE-2025-66629.htmlThu, 15 Oct 2026 21:10:00 +0000LOW 3.7: HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response https://patchthecve.com/cve/CVE-2025-32391.htmlhttps://patchthecve.com/cve/CVE-2025-32391.htmlWed, 17 Jun 2026 09:11:55 +0000MEDIUM 6.4: HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gishttps://patchthecve.com/cve/CVE-2024-45308.htmlhttps://patchthecve.com/cve/CVE-2024-45308.htmlWed, 17 Jun 2026 07:53:59 +0000MEDIUM 6.5: HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the