Thephpleague vulnerabilities

Products

• Commonmark 18
• Flysystem 2

Newest

• thephpleague commonmark league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser CVE-2026-105830 Fix available 8.7 HighOctober 8, 2026
• thephpleague flysystem Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter CVE-2026-102601 Fix available 3.5 LowSeptember 29, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote CVE-2026-86435 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision CVE-2026-86434 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes CVE-2026-86433 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 2.0.0 before 2.8.4 Denial of Service via XML CVE-2026-86432 Fix available 6.9 MediumSeptember 7, 2026
• thephpleague commonmark commonmark before 2.9.1 XSS via AttributesExtension form feed bypass CVE-2026-86431 Fix available 6.9 MediumSeptember 7, 2026
• thephpleague commonmark league/commonmark before 2.9.1 Denial of Service via parsing CVE-2026-86430 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes CVE-2026-86429 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes CVE-2026-86428 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass CVE-2026-105829 Fix available 5.3 MediumAugust 6, 2026
• thephpleague commonmark league/commonmark: Quadratic-time denial of service when parsing crafted Markdown CVE-2026-71488 Fix available 7.5 HighAugust 6, 2026
• thephpleague commonmark league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVE-2026-71478 Fix available 6.1 MediumAugust 6, 2026
• thephpleague commonmark league/commonmark has an embed extension allowed_domains bypass CVE-2026-33347 Fix available 6.3 MediumMarch 19, 2026
• thephpleague commonmark league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names CVE-2026-30838 Fix available 5.1 MediumMarch 6, 2026
• thephpleague commonmark league/commonmark Cross-site Scripting vulnerability in Attributes extension CVE-2025-46734 Fix available 6.4 MediumMay 5, 2025
• thephpleague commonmark league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity CVE-2024-58382 Fix available 8.7 HighDecember 9, 2024
• oauth2-server project oauth2-server league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase CVE-2023-37260 Fix available 8.2 HighJuly 6, 2023
• thephpleague flysystem, fedoraproject fedora +1 more Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVE-2021-32708 Public exploitFix available 9.8 CriticalJune 24, 2021
• thephpleague commonmark Moderate severity vulnerability that affects league/commonmark CVE-2019-10010 Fix available 6.1 MediumMarch 24, 2019
• thephpleague commonmark PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) CVE-2018-20583 Fix available 6.1 MediumDecember 30, 2018