What’s Vulnerable › Products

MarkUsProject Markus vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your MarkUsProject Markus version is affected

Latest MarkUsProject Markus vulnerabilities

• CVE-2026-27807 — MarkUs: YAML alias (‘billion laughs’) DoS in config upload (CVSS 4.9)
• CVE-2026-25962 — MarkUs: Zip bomb in config upload enables DoS (CVSS 6.5)
• CVE-2026-28405 — MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions (CVSS 5.4)
• CVE-2026-25057 — Zip Slip in MarkUs config upload allowing RCE (CVSS 9.1)
• CVE-2026-24900 — MarkUs has a submission-view IDOR exposes all student submissions (CVSS 6.5)
• CVE-2024-51743 — Arbitrary File Write leading up to remote code execution (instructor accounts) (CVSS 8.8)
• CVE-2024-51499 — MarkUs Arbitrary File Write leading up to remote code execution (student accounts) (CVSS 8.8)
• CVE-2024-47820 — MarkUs vulnerable to Path Traversal (CVSS 3.5)