CO
Product
commonmark
17
CVEs
0
On KEV
7.5
Max CVSS
1
New 30D
Severity mix
Critical 0High 10Medium 7Low 0
Watch
Add commonmark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-46734 | 6.4 | May 5 | league/commonmark Cross-site Scripting vulnerability in Attributes extension Affected: < 2.7.0 |
| CVE-2026-71478 | 6.1 | Aug 6 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes Affected: >= 1.5.0, <= 2.8.3 |
| CVE-2026-33347 | 6.1 | Mar 24 | league/commonmark has an embed extension allowed_domains bypass Affected: >= 2.3.0, < 2.8.2 |
| CVE-2026-30838 | 6.1 | Mar 7 | league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names Affected: < 2.8.1 |
| CVE-2019-10010 | 6.1 | Mar 24 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML… Affected: before 0.18.3 |
| CVE-2018-20583 | 6.1 | Dec 30 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML… Affected: 0.15.6 through 0.18.0 |
| CVE-2026-86432 | 5.3 | Sep 7 | commonmark 2.0.0 before 2.8.4 Denial of Service via XML Affected: 2.0.0 before 2.8.4 |
Showing 7