thephpleague vulnerabilities
19 published CVEs name thephpleague among the affected products.
- 19Published CVEs19 of them scored
- 16Last 12 monthspublished in the last year
- 1Critical10 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
thephpleague · commonmark
High8.7 - CVE-2026-105829
League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
thephpleague · commonmark
Medium5.3 - CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
thephpleague · flysystem
Low3.5 - CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
thephpleague · commonmark
High8.7 - CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
thephpleague · commonmark
High8.7 - CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
thephpleague · commonmark
High8.7 - CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
thephpleague · commonmark
High8.7 - CVE-2026-86432
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
thephpleague · commonmark
Medium6.9 - CVE-2026-86431
commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
thephpleague · commonmark
Medium6.9 - CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing
thephpleague · commonmark
High8.7