CVE-2026-27807
Medium · 4.9CVSS
4.9
EPSS
0.5%
Published
Mar 6, 2026
CISA due date
—
The record
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-58234 SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted… CWE-776
- CVE-2026-16180 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-776
- CVE-2026-78681 NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules… CWE-776
- CVE-2026-3415 The XML and schema validation functionalities within the SchemaValidator Mediator process… CWE-776
- CVE-2026-44018 Docling simplifies document processing by parsing diverse formats and providing… CWE-776
- CVE-2026-12993 A flaw was found in Apicurio Registry. CWE-776
- CVE-2026-44020 Docling simplifies document processing by parsing diverse formats and providing… CWE-776
- CVE-2026-45771 FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from… CWE-776