thephpleague vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20231
3. 20251
4. 202615
5. 20261

Newest CVEs

• CVE-2026-105830

  league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

  thephpleague · commonmark

  High8.7
• CVE-2026-105829

  League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass

  thephpleague · commonmark

  Medium5.3
• CVE-2026-102601

  Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

  thephpleague · flysystem

  Low3.5
• CVE-2024-58382

  league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

  thephpleague · commonmark

  High8.7
• CVE-2026-86435

  commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

  thephpleague · commonmark

  High8.7
• CVE-2026-86434

  commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

  thephpleague · commonmark

  High8.7
• CVE-2026-86433

  commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes

  thephpleague · commonmark

  High8.7
• CVE-2026-86432

  commonmark 2.0.0 before 2.8.4 Denial of Service via XML

  thephpleague · commonmark

  Medium6.9
• CVE-2026-86431

  commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

  thephpleague · commonmark

  Medium6.9
• CVE-2026-86430

  league/commonmark before 2.9.1 Denial of Service via parsing

  thephpleague · commonmark

  High8.7