Log in Start free

thephpleague

Products

ProductCVEsExploitedLatest
commonmark16–Oct 8, 2026
flysystem2–Sep 29, 2026
oauth2-server1–Jul 6, 2023

Exploited and recent CVEs

  • CVE-2026-105830 High 7.5 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser 0.4%
  • CVE-2026-105829 Medium 6.1 League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass 0.2%
  • CVE-2026-102601 Low 3.5 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter 0.3%
  • CVE-2024-58382 High 7.5 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity 0.5%
  • CVE-2026-86435 High 7.5 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote 0.5%
  • CVE-2026-86434 High 7.5 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision 0.5%
  • CVE-2026-86433 High 7.5 commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes 0.5%
  • CVE-2026-86432 Medium 5.3 commonmark 2.0.0 before 2.8.4 Denial of Service via XML 0.4%
  • CVE-2026-86431 High 7.2 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass 0.4%
  • CVE-2026-86430 High 7.5 league/commonmark before 2.9.1 Denial of Service via parsing 0.5%
  • CVE-2026-86429 High 7.5 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes 0.5%
  • CVE-2026-86428 High 7.5 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes 0.5%
  • CVE-2026-71488 High 7.5 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown 0.6%
  • CVE-2026-71478 Medium 6.1 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes 0.4%
  • CVE-2026-33347 Medium 6.3 league/commonmark has an embed extension allowed_domains bypass 0.2%
  • CVE-2026-30838 Medium 5.1 league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names 0.2%
  • CVE-2025-46734 Medium 6.4 league/commonmark Cross-site Scripting vulnerability in Attributes extension 0.4%
  • CVE-2023-37260 High 8.2 league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase 1.0%
  • CVE-2021-32708 Critical 9.8 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem 3.5%