thephpleague commonmark

• CVE-2026-105830 High 7.5 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser 0.4%
• CVE-2026-105829 Medium 6.1 League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass 0.2%
• CVE-2024-58382 High 7.5 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity 0.5%
• CVE-2026-86435 High 7.5 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote 0.5%
• CVE-2026-86434 High 7.5 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision 0.5%
• CVE-2026-86433 High 7.5 commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes 0.5%
• CVE-2026-86432 Medium 5.3 commonmark 2.0.0 before 2.8.4 Denial of Service via XML 0.4%
• CVE-2026-86431 High 7.2 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass 0.4%
• CVE-2026-86430 High 7.5 league/commonmark before 2.9.1 Denial of Service via parsing 0.5%
• CVE-2026-86429 High 7.5 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes 0.5%
• CVE-2026-86428 High 7.5 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes 0.5%
• CVE-2026-71488 High 7.5 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown 0.6%
• CVE-2026-71478 Medium 6.1 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes 0.4%
• CVE-2026-33347 Medium 6.3 league/commonmark has an embed extension allowed_domains bypass 0.2%
• CVE-2026-30838 Medium 5.1 league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names 0.2%
• CVE-2025-46734 Medium 6.4 league/commonmark Cross-site Scripting vulnerability in Attributes extension 0.4%