CO
Product
commonmark
17
CVEs
0
On KEV
7.5
Max CVSS
1
New 30D
Severity mix
Critical 0High 10Medium 7Low 0
Watch
Add commonmark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105830 | 7.5 | Oct 8 | league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser Affected: 2.0.0 before 2.10.2 |
| CVE-2024-58382 | 7.5 | Sep 9 | league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity Affected: before 2.6.0 |
| CVE-2026-86435 | 7.5 | Sep 7 | commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote Affected: 1.5.0 before 2.8.4 |
| CVE-2026-86434 | 7.5 | Sep 7 | commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision Affected: 2.0.0 before 2.8.4 |
| CVE-2026-86433 | 7.5 | Sep 7 | commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes Affected: 1.5.0 before 2.8.4 |
| CVE-2026-86430 | 7.5 | Sep 7 | league/commonmark before 2.9.1 Denial of Service via parsing Affected: 0.6.0 before 2.9.1 |
| CVE-2026-86429 | 7.5 | Sep 7 | commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes Affected: 1.5.0 before 2.9.1 |
| CVE-2026-86428 | 7.5 | Sep 7 | commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes Affected: 1.5.0 before 2.10.0 |
| CVE-2026-71488 | 7.5 | Aug 6 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown Affected: >= 0.6.0, < 2.9.0 |
| CVE-2026-86431 | 7.2 | Sep 7 | commonmark before 2.9.1 XSS via AttributesExtension form feed bypass Affected: 2.7.0 before 2.9.1 |
| CVE-2025-46734 | 6.4 | May 5 | league/commonmark Cross-site Scripting vulnerability in Attributes extension Affected: < 2.7.0 |
| CVE-2026-71478 | 6.1 | Aug 6 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes Affected: >= 1.5.0, <= 2.8.3 |
| CVE-2026-33347 | 6.1 | Mar 24 | league/commonmark has an embed extension allowed_domains bypass Affected: >= 2.3.0, < 2.8.2 |
| CVE-2026-30838 | 6.1 | Mar 7 | league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names Affected: < 2.8.1 |
| CVE-2019-10010 | 6.1 | Mar 24 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML… Affected: before 0.18.3 |
| CVE-2018-20583 | 6.1 | Dec 30 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML… Affected: 0.15.6 through 0.18.0 |
| CVE-2026-86432 | 5.3 | Sep 7 | commonmark 2.0.0 before 2.8.4 Denial of Service via XML Affected: 2.0.0 before 2.8.4 |
Showing 17