Vendor

    Thephpleague

    21 known vulnerabilities in products by Thephpleague, 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Thephpleague
    CriticalCVE-2021-32708

    Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

    also in 1 other product

    		9.8
    HighCVE-2026-86429

    commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

    		7.5
    HighCVE-2026-86434

    commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

    		7.5
    HighCVE-2026-86433

    commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes

    		7.5
    HighCVE-2026-86428

    commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

    		7.5
    HighCVE-2024-58382

    league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

    		7.5
    HighCVE-2026-86430

    league/commonmark before 2.9.1 Denial of Service via parsing

    		7.5
    HighCVE-2026-86435

    commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

    		7.5
    MediumCVE-2018-20583

    thephpleague (The League of Extraordinary Packages) CommonMark: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2026-105830

    league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

    		7.5
    HighCVE-2026-71488

    league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

    		7.5
    HighCVE-2023-37260

    Thephpleague Oauth2-server: Generation of Error Message Containing Sensitive Information

    		8.2
    MediumCVE-2026-86432

    commonmark 2.0.0 before 2.8.4 Denial of Service via XML

    		5.3
    HighCVE-2026-86431

    commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

    		7.2
    MediumCVE-2019-10010

    thephpleague (The League of Extraordinary Packages) CommonMark: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2026-105829

    League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass

    		6.1
    MediumCVE-2026-71478

    league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

    		6.1
    LowCVE-2026-102601

    Thephpleague Flysystem: Improper Neutralization of Escape, Meta, or Control Sequences

    		3.5
    MediumCVE-2025-46734

    league/commonmark Cross-site Scripting vulnerability in Attributes extension

    		6.4
    MediumCVE-2026-33347

    league/commonmark has an embed extension allowed_domains bypass

    		6.1
    MediumCVE-2026-30838

    league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names

    		6.1

    Products

    Products by Thephpleague
    thephpleague (The League of Extraordinary Packages) CommonMark180