Advisories

Listing reported advisories sorted by their report date.

Kirby CMS has Persistent DoS via Malformed Image Upload
GitHub

getkirby/cms

< 5.2.0-rc.1

2026-03-27 22:21:29
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
GitHub

aws/aws-sdk-php

>= 3.11.7, <= 3.371.3

2026-03-27 19:55:01
Saloon has insecure deserialization in AccessTokenAuthenticator
GitHub

saloonphp/saloon

< 4.0.0

2026-03-27 18:33:44
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
GitHub

dolibarr/dolibarr

<= 22.0.4

2026-03-27 18:04:20
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client
GitHub

hybridauth/hybridauth

<= 3.12.2

2026-03-27 17:53:24
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
GitHub

miraheze/ts-portal

<= 33

2026-03-27 15:42:23
TSPortal: Any user can forge self-deletion requests for any account
GitHub

miraheze/ts-portal

<= 29

2026-03-27 15:37:13
Statamic allows unauthorized content access through missing authorization in its revision controllers
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.2 · < 5.73.16

2026-03-26 19:07:24
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
GitHub

statamic/cms

>= 5.73.12, < 5.73.16 · >= 6.5.0, < 6.7.2

2026-03-26 19:06:59
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
GitHub

statamic/cms

>= 6.0.0.alpha.1, < 6.7.2 · < 5.73.16

2026-03-26 19:05:58
Statamic's live preview token bypasses content protection for unrelated entries
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.2 · < 5.73.16

2026-03-26 19:05:48
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.2 · < 5.73.16

2026-03-26 19:05:28
Statamic's Markdown preview endpoint exposes sensitive user data
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.2 · < 5.73.16

2026-03-26 19:03:04
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
GitHub

concrete5/concrete5

<= 9.4.7

2026-03-26 18:38:50
AVideo has Plaintext Video Password Storage
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:16:41
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:15:11
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
GitHub

wwbn/avideo

< 26.0

2026-03-26 18:12:36
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
GitHub

wwbn/avideo

<= 14.3

2026-03-26 18:10:50
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:08:14
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:07:38
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:06:40
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:05:40
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
GitHub

librenms/librenms

>= 1.48, < 26.3.0

2026-03-26 18:04:03
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.13 · >= 4.0.0-RC1, <= 4.17.7

2026-03-26 17:12:25
Saloon has a Fixture Name Path Traversal Vulnerability
GitHub

saloonphp/saloon

< 4.0.0

2026-03-25 22:00:45
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL
GitHub

saloonphp/saloon

< 4.0.0

2026-03-25 22:00:15
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:56:15
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:55:35
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:39
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:23
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
GitHub

google/protobuf

< 4.33.6

2026-03-25 21:02:08
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.2 · >= 6.0.0-alpha.1, < 6.4.0 · < 5.73.16 · < 5.73.11

2026-03-25 20:57:25
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
GitHub

mantisbt/mantisbt

= 2.28.0

2026-03-25 20:09:10
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
GitHub

code16/sharp

< 9.20.0

2026-03-25 20:01:05
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
GitHub

code16/sharp

< 9.20.0

2026-03-25 20:00:24
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
GitHub

putyourlightson/craft-sprig

>= 3.0.0, < 3.15.2 · >= 2.0.0, < 2.15.2 · >= 3.0.0, < 3.7.2

2026-03-25 19:59:22
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
GitHub

mantisbt/mantisbt

= 2.28.0

2026-03-25 19:56:02
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:54:44
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:56
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
GitHub

ralffreit/mfa-email

<= 2.0.0 · = 2.0.0 · < 1.0.7

2026-03-25 19:53:21
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:01
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:43
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:23
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:51:48
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
GitHub

prestashop/prestashop

>= 9.0.0-alpha.1, < 9.1.0 · < 8.2.5

2026-03-25 19:41:50
PrestaShop: Improper Use of Validation Framework
GitHub

prestashop/prestashop

>= 9.0.0-alpha.1, < 9.1.0 · < 8.2.5

2026-03-25 19:40:45
WeChat Pay callback signature verification bypassed when Host header is localhost
GitHub

yansongda/pay

<= 3.7.19

2026-03-25 19:30:09
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:50:16
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:49:33
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:48:18
« Previous Next »

Showing 1 to 50 of 6751 results

1 2 3 4 5 6 7 8 9 10 ... 135 136