thephpleague commonmark
16 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-105830 | 2.0.0 – < 2.10.2 | league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser | HIGH 8.7 | 0.4 % | ||
| CVE-2026-105829 | | League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-58382 | < 2.6.0 | league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86435 | 1.5.0 – < 2.8.4 | commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86434 | 2.0.0 – < 2.8.4 | commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86433 | 1.5.0 – < 2.8.4 | commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86432 | 2.0.0 – < 2.8.4 | commonmark 2.0.0 before 2.8.4 Denial of Service via XML | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-86431 | 2.7.0 – < 2.9.1 | commonmark before 2.9.1 XSS via AttributesExtension form feed bypass | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-86430 | 0.6.0 – < 2.9.1 | league/commonmark before 2.9.1 Denial of Service via parsing | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86429 | 1.5.0 – < 2.9.1 | commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes | HIGH 8.7 | 0.5 % | ||
| CVE-2026-86428 | 1.5.0 – < 2.10.0 | commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes | HIGH 8.7 | 0.5 % | ||
| CVE-2026-71488 | >= 0.6.0, < 2.9.0 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown | HIGH 7.5 | 0.6 % | ||
| CVE-2026-71478 | >= 1.5.0, <= 2.8.3 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-33347 | >= 2.3.0, < 2.8.2 | league/commonmark has an embed extension allowed_domains bypass | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-30838 | < 2.8.1 | league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names | MEDIUM 5.1 | 0.2 % | ||
| CVE-2025-46734 | < 2.7.0 | league/commonmark Cross-site Scripting vulnerability in Attributes extension | MEDIUM 6.4 | 0.4 % |