Thephpleague Commonmark vulnerabilities

• thephpleague commonmark league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser CVE-2026-105830 Fix available 8.7 HighOctober 8, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote CVE-2026-86435 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision CVE-2026-86434 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes CVE-2026-86433 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 2.0.0 before 2.8.4 Denial of Service via XML CVE-2026-86432 Fix available 6.9 MediumSeptember 7, 2026
• thephpleague commonmark commonmark before 2.9.1 XSS via AttributesExtension form feed bypass CVE-2026-86431 Fix available 6.9 MediumSeptember 7, 2026
• thephpleague commonmark league/commonmark before 2.9.1 Denial of Service via parsing CVE-2026-86430 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes CVE-2026-86429 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes CVE-2026-86428 Fix available 8.7 HighSeptember 7, 2026
• thephpleague commonmark League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass CVE-2026-105829 Fix available 5.3 MediumAugust 6, 2026
• thephpleague commonmark league/commonmark: Quadratic-time denial of service when parsing crafted Markdown CVE-2026-71488 Fix available 7.5 HighAugust 6, 2026
• thephpleague commonmark league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVE-2026-71478 Fix available 6.1 MediumAugust 6, 2026
• thephpleague commonmark league/commonmark has an embed extension allowed_domains bypass CVE-2026-33347 Fix available 6.3 MediumMarch 19, 2026
• thephpleague commonmark league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names CVE-2026-30838 Fix available 5.1 MediumMarch 6, 2026
• thephpleague commonmark league/commonmark Cross-site Scripting vulnerability in Attributes extension CVE-2025-46734 Fix available 6.4 MediumMay 5, 2025
• thephpleague commonmark league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity CVE-2024-58382 Fix available 8.7 HighDecember 9, 2024
• thephpleague commonmark Moderate severity vulnerability that affects league/commonmark CVE-2019-10010 Fix available 6.1 MediumMarch 24, 2019
• thephpleague commonmark PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) CVE-2018-20583 Fix available 6.1 MediumDecember 30, 2018