Packagist league/commonmark

Name: Packagist league/commonmark
Brand: Packagist

productUS

pkg:composer/league/commonmark

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

critical

by severity

0critical7high5medium0low

updated 2026-10-28

vulnerabilities (15)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-20583US	medium6.1	1.86% (79th)	—	0.18.1	2018-12-30	0.15.6 → 0.18.1
CVE-2019-10010US	medium6.1	1.05% (64th)	—	0.18.3	2019-03-24	< 0.18.3
CVE-2026-71488US	—	0.63% (50th)	—	2.9.0	2026-08-06	0.6.0 → 2.9.0
CVE-2026-86429US	high7.5	0.52% (44th)	—	2.9.1	2026-09-07	1.5.0 → 2.9.1
CVE-2026-86434US	high7.5	0.51% (43rd)	—	2.9.0	2026-09-07	2.0.0 → 2.9.0
CVE-2026-86430US	high7.5	0.49% (42nd)	—	2.9.1	2026-09-07	0.6.0 → 2.9.1
CVE-2026-86428US	high7.5	0.49% (42nd)	—	2.10.0	2026-09-07	1.5.0 → 2.10.0
CVE-2024-58382US	high7.5	0.49% (42nd)	—	2.6.0	2026-09-09	< 2.6.0
CVE-2026-86431US	high7.2	0.39% (33rd)	—	2.9.1	2026-09-07	2.7.0 → 2.9.1
CVE-2025-46734US	—	0.38% (32nd)	—	2.7.0	2025-05-05	1.5.0 → 2.7.0
CVE-2026-105830US	high7.5	0.37% (30th)	—	2.10.2	2026-10-08	2.0.0 → 2.10.2
CVE-2026-71478US	—	0.36% (29th)	—	2.9.0	2026-08-06	1.5.0 → 2.9.0
CVE-2026-105829US	medium6.1	0.25% (16th)	—	2.10.2	2026-10-08	1.3.0 → 2.10.2
CVE-2026-33347US	medium6.1	0.25% (16th)	—	2.8.2	2026-03-24	2.3.0 → 2.8.2
CVE-2026-30838US	medium6.1	0.23% (13th)	—	2.8.1	2026-03-07	2.0.0 → 2.8.1

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8 CVEs
CWE-407Inefficient Algorithmic Complexity7 CVEs
CWE-1050Excessive Platform Resource Consumption within a Loop4 CVEs
CWE-86Improper Neutralization of Invalid Characters in Identifiers in Web Pages2 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-185Incorrect Regular Expression1 CVEs
CWE-400Uncontrolled Resource Consumption1 CVEs
CWE-692Incomplete Denylist to Cross-Site Scripting1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.