CVE-2026-86432

commonmark (versions 2.0.0 through before 2.8.4) contains a denial of service vulnerability in its XmlRenderer component. The root cause is that the renderer emits depth-proportional indentation for every XML tag, so deeply nested Markdown or AST structures trigger quadratic memory consumption an...

EUVD-2026-72388

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...

CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...

CVE-2026-86429

CVE-2026-86429 affects the thephpleague/commonmark PHP library (versions ≥ 1.5.0,

CVE-2026-86303 92181 markdown md.c lds out-of-bounds

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for...

CVE-2026-86303

CVE-2026-86303 affects the 92181 markdown C library (GitHub repo 92181/markdown). The vulnerability is an out-of-bounds read in the function lds within md.c. The flaw can be triggered remotely with no authentication or user interaction required, carrying a CVSS 3.1 score of 7.3 (HIGH) with low im...

EUVD-2026-72359

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for...

CVE-2026-86303 92181 markdown md.c lds out-of-bounds

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for...

PT-2026-86796

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

Linux Distros Unpatched Vulnerability : CVE-2026-86431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an...

CVE-2026-86303: Out-of-bounds Read

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for...

Linux Distros Unpatched Vulnerability : CVE-2026-86430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and...

Linux Distros Unpatched Vulnerability : CVE-2026-86429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and...

CVE-2026-86428: Inefficient Algorithmic Complexity

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

PT-2026-86764

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for...

Linux Distros Unpatched Vulnerability : CVE-2026-86434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its...

EUVD-2026-71624

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...