Read the docs

thephpleague

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

thephpleague records in CISA KEV

No thephpleague vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Commonmark 8 records MEDIUM Flysystem 1 record MEDIUM Oauth2-server 1 record MEDIUM

Records

8 records in Commonmark · all components

TI-2026-59138 CVE-2026-86430 · GHSA-hxrj-xxg4-w3qp

league/commonmark before 2.9.1 Denial of Service via parsing

Priority MEDIUM 44

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-09-07 Fixed in 2.9.1 CWE-407
TI-2026-59137 CVE-2026-86429 · GHSA-7x8h-jg2x-pjm5

commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Priority MEDIUM 44

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00515 Published 2026-09-07 Fixed in 2.9.1 CWE-407
TI-2026-59136 CVE-2026-86428 · GHSA-8h74-w38m-j62j

commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

Priority MEDIUM 44

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-09-07 Fixed in 2.10.0 CWE-407
TI-2018-14605 CVE-2018-20583 · GHSA-qx76-c53f-5c7q

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions…

Priority LOW 31

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01863 Published 2018-12-30 Fixed in 0.18.1 CWE-79
TI-2019-07346 CVE-2019-10010 · GHSA-3v43-877x-qgmq

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before…

Priority LOW 29

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped dur…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0105 Published 2019-03-24 Fixed in 0.18.3 CWE-79
Open these records in search →