Advisories

Listing reported advisories sorted by their report date.

formie's unauthenticated front-end submission editing can overwrite existing submissions
GitHub

verbb/formie

>= 3.0.0, < 3.1.26 · < 2.2.21

2026-05-29 22:19:21
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:09:40
Admidio writes session IDs and auto-login cookie values to application logs
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:07:53
Admidio PKCS#12 private key export action lacks CSRF protection
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:07:27
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:06:52
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:05:47
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 22:02:02
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 21:58:48
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 21:57:08
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
GitHub

admidio/admidio

<= 5.0.9

2026-05-29 21:54:12
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
GitHub

symfony/symfony

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.4.0, < 6.4.40

2026-05-29 21:32:26
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
GitHub

phanan/koel

<= 9.3.4

2026-05-29 19:56:08
ezsystems/ezpublish-legacy has a SQL injection in dfscleanup
GitHub

ezsystems/ezpublish-legacy

= 2019.03

2026-05-29 19:07:41
Froxlor has an incomplete fix for CVE-2026-30932
GitHub

froxlor/froxlor

<= 2.3.6

2026-05-29 15:45:32
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
GitHub

froxlor/froxlor

= 2.3.6

2026-05-29 15:40:24
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
GitHub

froxlor/froxlor

= 2.3.6

2026-05-29 15:36:27
Cross-site scripting (XSS) via script break-out in toScript() output
FriendsOfPHP

spatie/schema-org

>=3.23.1, <3.23.2 · >=4.0.0, <4.0.2

2026-05-29 07:46:00
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
GitHub

pimcore/pimcore

<= 12.3.6

2026-05-28 20:47:10
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
GitHub

symfony/polyfill

>= 1.17.1, < 1.38.1

2026-05-28 19:52:37
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
GitHub

symfony/json-path

>= 8.0.0, < 8.0.12 · >= 7.3.0, < 7.4.12

2026-05-28 17:34:56
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
GitHub

symfony/mailtrap-mailer

>= 8.0.0, < 8.0.12 · >= 7.2.0, < 7.4.12

2026-05-28 17:33:48
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
GitHub

symfony/lox24-notifier

>= 8.0.0, < 8.0.12 · >= 7.1.0, < 7.4.12 · >= 7.0.0, < 7.4.12 · >= 6.4.0, < 6.4.40

2026-05-28 17:22:37
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-28 16:43:28
Pimcore has a CustomReports Share Bypass
GitHub

pimcore/pimcore

<= 12.3.5

2026-05-27 22:34:01
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
GitHub

pimcore/pimcore

<= 12.3.6

2026-05-27 22:27:19
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:34:37
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:33:52
Symfony hardened the parser when handling untrusted input
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:33:09
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
GitHub

automad/automad

>= 2.0.0-alpha.1, <= 2.0.0-beta.27

2026-05-27 21:32:32
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
GitHub

symfony/monolog-bridge

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:13:31
Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
GitHub

symfony/http-kernel

>= 8.0.0, < 8.0.12 · >= 7.4.0, < 7.4.12

2026-05-27 21:12:39
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
GitHub

symfony/security-http

>= 8.0.0, < 8.0.12 · >= 7.1.0, < 7.4.12

2026-05-27 21:12:00
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
GitHub

symfony/cache

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:11:23
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
GitHub

symfony/symfony

>= 6.4.24, < 6.4.40 · >= 8.0.0, < 8.0.12 · >= 7.2.9, < 7.4.12

2026-05-27 21:10:45
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
GitHub

symfony/dom-crawler

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:09:45
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
GitHub

symfony/mime

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:09:13
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
GitHub

symfony/security-http

>= 8.0.0, < 8.0.12 · >= 7.4.0, < 7.4.12 · >= 6.3.0, < 6.4.40

2026-05-27 21:03:38
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
GitHub

symfony/mailer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 20:46:06
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
GitHub

symfony/mime

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 20:42:08
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-27 20:13:05
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-27 20:04:23
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-27 17:42:04
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-27 17:23:32
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
GitHub

pimcore/pimcore

<= 12.3.6

2026-05-27 17:17:18
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
GitHub

pimcore/pimcore

<= 12.3.6

2026-05-27 16:57:05
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
GitHub

symfony/routing

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 16:55:18
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
GitHub

symfony/security-http

>= 8.0.0-BETA1, < 8.0.12 · >= 7.0.0-BETA1, < 7.4.12 · >= 6.0.0-BETA1, < 6.4.40 · < 5.4.52

2026-05-27 16:51:09
Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via dynamic mapping keys
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
« Previous Next »

Showing 1 to 50 of 7292 results

1 2 3 4 5 6 7 8 9 10 ... 145 146