https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T01:33:31.240950+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-105829 fkie_cve-2026-105829 2026-10-16T01:33:31.243056+00:00

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

 https://db.gcve.eu/vuln/ghsa-6vmm-7pc2-g2g6 GHSA-6vmm-7pc2-g2g6 2026-10-16T01:33:31.243134+00:00

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-105829 UBUNTU-CVE-2026-105829 2026-10-16T01:33:31.243159+00:00

Affected: Ubuntu:Pro:20.04:LTS: php-league-commonmark, Ubuntu:Pro:22.04:LTS: php-league-commonmark, Ubuntu:Pro:24.04:LTS: php-league-commonmark, Ubuntu:26.04:LTS: php-league-commonmark

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.