T
Vendor security profile
thephpleague
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical0
CISA KEV0
Public exploit5
Patch rate%29
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
10
2
CVE KEV
CVE severity distribution
14toplam CVE
High9 (64%)
Medium4 (29%)
Low1 (7%)
Patch and exploitation view
%29
Verified patch
%0
CISA KEV
%36
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
10Unknown
Latest vulnerabilities
8.7
CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
T
Patch status unknownEPSS %0
5.3
CVE-2026-105829
League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
T
Patch status unknownEPSS %0
3.5
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
T
Patch status unknownEPSS %0
8.7
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
T
Patch status unknownEPSS %0
8.7
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
T
Patch status unknownEPSS %0
8.7
CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
T
Patch status unknownEPSS %1
8.7
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
T
Patch status unknownEPSS %1
6.9
CVE-2026-86432
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
T
Patch status unknownEPSS %0
6.9
CVE-2026-86431
commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
T
Patch verifiedEPSS %0
8.7
CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing
T
Patch verifiedEPSS %0