Vulnerabilidades en thephpleague
19 resultadosCVE-2021-32708CRITICALTime-of-check Time-of-use (TOCTOU) Race Condition in league/flysystemEPSS 3.5%CVE-2023-37260HIGHleague/oauth2-server key exposed in exception message when passing as string and providing invalid pass phraseEPSS 1.0%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2026-86429HIGHcommonmark before 2.9.1 Denial of Service via SmartPunct and AttributesEPSS 0.5%CVE-2026-86433HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via AttributesEPSS 0.5%CVE-2026-86434HIGHcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionEPSS 0.5%CVE-2026-86428HIGHcommonmark 1.5.0 before 2.10.0 Denial of Service via AttributesEPSS 0.5%CVE-2026-86430HIGHleague/commonmark before 2.9.1 Denial of Service via parsingEPSS 0.5%CVE-2026-86435HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via FootnoteEPSS 0.5%CVE-2024-58382HIGHleague/commonmark before 2.6.0 Denial of Service via Quadratic ComplexityEPSS 0.5%CVE-2026-86432MEDIUMcommonmark 2.0.0 before 2.8.4 Denial of Service via XMLEPSS 0.4%CVE-2026-86431MEDIUMcommonmark before 2.9.1 XSS via AttributesExtension form feed bypassEPSS 0.4%CVE-2025-46734MEDIUMleague/commonmark Cross-site Scripting vulnerability in Attributes extensionEPSS 0.4%CVE-2026-105830HIGHleague/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParserEPSS 0.4%CVE-2026-71478MEDIUMleague/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesEPSS 0.4%CVE-2026-102601LOWFlysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterEPSS 0.3%CVE-2026-105829MEDIUMLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml BypassEPSS 0.3%CVE-2026-33347MEDIUMleague/commonmark has an embed extension allowed_domains bypassEPSS 0.3%CVE-2026-30838MEDIUMleague/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag namesEPSS 0.2%