When was CVE-2026-105829 disclosed?

CVE-2026-105829 was first published on October 8, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2026-105829 actively exploited?

CVE-2026-105829 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.2% probability of exploitation in the next 30 days (9th percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2026-105829?

CVE-2026-105829 has a CVSS base score of 6.1 (a secondary CVSS source that NVD displays; NVD's own analysis pending).

How do I remediate CVE-2026-105829?

A fix for CVE-2026-105829 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-105829 are linked in the Vendor Advisories panel on this page.

CVE-2026-105829

MEDIUMPre-NVD 6.16.1—Trending — 4 sources updated this week

6.1EG

EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 0.2%CVSS: 6.1Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone