TH
Vendor
thephpleague
20
CVEs
0
On KEV
2
New 30D
Products
CO7.5
commonmark
thephpleague
17 CVEs0 on KEV1 new
FL8.1
flysystem
thephpleague
2 CVEs0 on KEV1 new
OA7.5
Oauth2-server
Thephpleague
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105830 | CO commonmark thephpleague | 7.5 | Oct 8 | league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser |
| CVE-2026-102601 | FL flysystem thephpleague | 3.5 | Sep 29 | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter |
| CVE-2024-58382 | CO commonmark thephpleague | 7.5 | Sep 9 | league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity |
| CVE-2026-86435 | CO commonmark thephpleague | 7.5 | Sep 7 | commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote |
| CVE-2026-86434 | CO commonmark thephpleague | 7.5 | Sep 7 | commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision |
| CVE-2026-86433 | CO commonmark thephpleague | 7.5 | Sep 7 | commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes |
| CVE-2026-86432 | CO commonmark thephpleague | 5.3 | Sep 7 | commonmark 2.0.0 before 2.8.4 Denial of Service via XML |
| CVE-2026-86431 | CO commonmark thephpleague | 7.2 | Sep 7 | commonmark before 2.9.1 XSS via AttributesExtension form feed bypass |
| CVE-2026-86430 | CO commonmark thephpleague | 7.5 | Sep 7 | league/commonmark before 2.9.1 Denial of Service via parsing |
| CVE-2026-86429 | CO commonmark thephpleague | 7.5 | Sep 7 | commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes |
| CVE-2026-86428 | CO commonmark thephpleague | 7.5 | Sep 7 | commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes |
| CVE-2026-71488 | CO commonmark thephpleague | 7.5 | Aug 6 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown |
| CVE-2026-71478 | CO commonmark thephpleague | 6.1 | Aug 6 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes |
| CVE-2026-33347 | CO commonmark thephpleague | 6.1 | Mar 24 | league/commonmark has an embed extension allowed_domains bypass |
| CVE-2026-30838 | CO commonmark thephpleague | 6.1 | Mar 7 | league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names |
| CVE-2025-46734 | CO commonmark thephpleague | 6.4 | May 5 | league/commonmark Cross-site Scripting vulnerability in Attributes extension |
| CVE-2023-37260 | OA Oauth2-server Thephpleague | 7.5 | Jul 6 | league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP |
| CVE-2021-32708 | FL Flysystem Thephpleague | 8.1 | Jun 24 | Flysystem is an open source file storage library for PHP |
| CVE-2019-10010 | CO Commonmark Thephpleague | 6.1 | Mar 24 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML… |
| CVE-2018-20583 | CO Commonmark Thephpleague | 6.1 | Dec 30 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML… |