Laravel

CURLOPT_HTTPAUTH option not cleared on change of origin

high · CVE-2022-31090

Guzzle: Proxy-Authorization headers can be sent to origin servers

medium · CVE-2026-67339

Cross-domain cookie leakage in Guzzle

high · CVE-2022-29248

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

medium · CVE-2026-55767

Guzzle: Unbounded response cookies risk denial of service

medium · CVE-2026-67353

Guzzle: Noncanonical cookie domain keeps subdomain scope

medium · CVE-2026-69245

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

medium · CVE-2026-59883

Guzzle: URI fragments disclosed in redirect Referer headers

medium · CVE-2026-67354

HTTP Proxy header vulnerability

high · CVE-2016-5385

Change in port should be considered a change in origin

high · CVE-2022-31091

Guzzle: Noncanonical host can bypass host-based checks

high · CVE-2026-69246

Fix failure to strip Authorization header on HTTP downgrade

high · CVE-2022-31042

Guzzle: Host-only cookie scope is not preserved

medium · CVE-2026-67355

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

medium · CVE-2026-55568

guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

medium · CVE-2026-48998

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

medium · CVE-2026-59882

guzzlehttp/psr7 has CRLF Injection via URI Host Component

medium · CVE-2026-49214

Improper Input Validation in guzzlehttp/psr7

medium · CVE-2022-24775

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

medium · CVE-2026-55766

Improper header name validation in guzzlehttp/psr7

medium · CVE-2023-29197

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

medium · CVE-2026-71478

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

high · CVE-2026-71488

league/commonmark contains a XSS vulnerability in Attributes extension

medium · CVE-2025-46734

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

high · CVE-2026-105830

Moderate severity vulnerability that affects league/commonmark

medium · CVE-2019-10010

CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

unknown · CVE-2026-30838

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

high · CVE-2026-86428

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

medium · CVE-2026-105829

league/commonmark's quadratic complexity bugs may lead to a denial of service

high · CVE-2024-58382

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

high · CVE-2026-86431

league/commonmark: Denial of service via adjacent inline attribute blocks

high · GHSA-g2gp-3wwq-f4ph

league/commonmark has an embed extension allowed_domains bypass

unknown · CVE-2026-33347

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

high · CVE-2026-86430

league/commonmark: Denial of service via duplicate footnote definitions

high · GHSA-jfm3-95jq-q3rf

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

high · CVE-2026-86429

league/commonmark: Denial of service via colliding heading slugs

high · CVE-2026-86434

league/commonmark: Denial of service via deeply nested XML output

medium · GHSA-mj63-m3rc-8ppr

PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)

medium · CVE-2018-20583

Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

critical · CVE-2021-32708

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

low · CVE-2026-102601

Monolog Header injection in NativeMailerHandler

low · GHSA-f57v-q966-7fh6

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

unknown · CVE-2025-22145