Advisories

Listing reported advisories sorted by their report date.

Moodle affected by a code injection vulnerability
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · <= 5.1.1 · < 4.1.22

2026-01-26 17:41:33
phpMyFAQ: Public API endpoints expose emails and invisible questions
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:36
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:26
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:17
LavaLite CMS affected by a stored cross-site scripting vulnerability
GitHub

lavalite/cms

<= 10.1.0

2026-01-23 20:16:40
Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
GitHub

solspace/craft-freeform

<= 5.14.6

2026-01-22 21:41:15
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
GitHub

ph7software/ph7builder

<= 17.9.1

2026-01-22 18:04:54
CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier
GitHub

coreshop/core-shop

< 4.1.9

2026-01-21 16:13:13
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport
GitHub

cpsit/typo3-mailqueue

>= 0.5.0, < 0.5.1 · < 0.4.3

2026-01-21 15:47:44
MineAdmin improperly refreshes tokens
GitHub

mineadmin/mineadmin

<= 2.0.3

2026-01-21 15:47:34
Laravel Redis Horizontal Scaling Insecure Deserialization
GitHub

laravel/reverb

< 1.7.0

2026-01-21 15:40:25
Livewire Filemanager does not restrict uploaded file types
GitHub

livewire-filemanager/filemanager

<= 1.0.4

2026-01-20 18:17:04
Kimai has an Authenticated Server-Side Template Injection (SSTI)
GitHub

kimai/kimai

< 2.46.0

2026-01-20 17:07:17
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
GitHub

pterodactyl/panel

< 1.12.0

2026-01-20 16:30:18
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
GitHub

cakephp/cakephp

>= 5.2.10, < 5.2.12 · = 5.3.0

2026-01-16 21:00:47
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
GitHub

solspace/craft-freeform

>= 5.0.0-beta.1, < 5.5.9 · < 4.1.22

2026-01-15 22:41:40
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
GitHub

solspace/craft-freeform

< 4.1.23

2026-01-15 22:40:45
Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter
GitHub

aimeos/aimeos-laravel

= 2021.10

2026-01-15 22:38:53
solspace/craft-freeform Has a DoS Vulnerability
GitHub

solspace/craft-freeform

< 4.1.29

2026-01-15 22:31:39
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
GitHub

alextselegidis/easyappointments

<= 1.5.2

2026-01-15 20:11:24
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
GitHub

pimcore/web2print-tools-bundle

>= 6.0.0-RC1, <= 6.1 · <= 5.2.1

2026-01-15 18:14:28
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
GitHub

pimcore/admin-ui-classic-bundle

>= 2.0.0-RC1, <= 2.2.2 · <= 1.7.15

2026-01-15 18:13:28
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
GitHub

pimcore/pimcore

>= 12.0.0-RC1, <= 12.3 · <= 11.5.13

2026-01-15 18:12:49
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
GitHub

pimcore/pimcore

>= 12.0.0-RC1, <= 12.3 · <= 11.5.13

2026-01-15 18:11:48
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
GitHub

algolia/algoliasearch-magento-2

>= 3.17.0-beta.1, <= 3.17.1 · <= 3.16.1

2026-01-14 21:46:13
Pimcore Has an Incomplete Patch for CVE-2023-30848
GitHub

pimcore/pimcore

>= 12.0.0-RC1, < 12.3.1 · <= 11.5.13

2026-01-14 21:15:44
Shopware Has Improper Control of Generation of Code in Twig rendered views
GitHub

shopware/shopware

>= 6.7.0.0, < 6.7.6.1

2026-01-14 16:54:27
Concrete5 CMS contains an XPath injection vulnerability
GitHub

concrete5/concrete5

= 9.1.3

2026-01-14 16:53:52
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
GitHub

typo3/cms-core

>= 13.0.0, <= 13.4.22 · >= 12.0.0, <= 12.4.40 · >= 11.0.0, <= 11.5.48 · >= 10.0.0, <= 10.4.54 · >= 14.0.0, <= 14.0.1

2026-01-13 21:54:10
TYPO3 CMS Allows Broken Access Control in Recycler Module
GitHub

typo3/cms-recycler

>= 13.0.0, <= 13.4.22 · >= 12.0.0, <= 12.4.40 · >= 11.0.0, <= 11.5.48 · >= 10.0.0, <= 10.4.54 · >= 14.0.0, <= 14.0.1

2026-01-13 20:37:44
TYPO3 CMS Allows Broken Access Control in Redirects Module
GitHub

typo3/cms-redirects

>= 13.0.0, <= 13.4.22 · >= 12.0.0, <= 12.4.40 · >= 11.0.0, <= 11.5.48 · >= 10.0.0, <= 10.4.54 · >= 14.0.0, <= 14.0.1

2026-01-13 20:37:39
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
GitHub

typo3/cms-backend

>= 13.0.0, <= 13.4.22 · >= 12.0.0, <= 12.4.40 · >= 11.0.0, <= 11.5.48 · >= 10.0.0, <= 10.4.54 · >= 14.0.0, <= 14.0.1

2026-01-13 20:37:34
October CMS Vulnerable to Stored XSS via Branding Styles
GitHub

october/system

>= 4.0.0, <= 4.0.11 · <= 3.7.12

2026-01-09 20:12:25
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
GitHub

october/system

>= 4.0.0, <= 4.0.11 · <= 3.7.12

2026-01-09 18:12:59
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
GitHub

drupal/core

>= 11.2.0, < 11.2.8 · >= 11.0.0, < 11.1.9 · >= 10.5.0, < 10.5.6 · >= 8.0.0, < 10.4.9 · >= 7.0, < 7.103

2026-01-08 21:24:15
Kirby is missing permission checks in the content changes API
GitHub

getkirby/cms

>= 5.0.0, <= 5.2.1

2026-01-08 20:32:07
CoreShop Vulnerable to SQL Injection via Admin Reports
GitHub

coreshop/core-shop

<= 4.1.7

2026-01-07 19:29:52
Pterodactyl TOTPs can be reused during validity window
GitHub

pterodactyl/panel

< 1.12.0

2026-01-06 17:20:58
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
GitHub

pterodactyl/panel

< 1.12.0

2026-01-06 17:18:57
libsodium has Incomplete List of Disallowed Inputs
GitHub

paragonie/sodium_compat

>= 2, < 2.5.0 · < 1.24.0

2026-01-06 17:12:26
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
GitHub

redaxo/source

<= 5.20.1

2026-01-05 20:02:59
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 18:50:15
Unauthenticated Craft CMS users can trigger a database backup
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.20 · >= 3.0.0, <= 4.16.16

2026-01-05 18:49:58
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 18:10:57
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.20 · >= 3.5.0, <= 4.16.16

2026-01-05 18:02:39
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 17:42:32
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
GitHub

facturascripts/facturascripts

= 2025.43 · = 2025.41 · = 2025.11 · <= 2025.4

2026-01-02 22:51:53
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:51:43
Bagisto has IDOR in Customer Order Reorder Functionality
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:50:48
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:13:41
« Previous Next »

Showing 1 to 50 of 6454 results

1 2 3 4 5 6 7 8 9 10 ... 129 130