Advisories

Listing reported advisories sorted by their report date.

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
GitHub

mantisbt/mantisbt

< 2.27.2

2025-11-03 17:07:37
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
GitHub

statamic/cms

<= 5.22.0

2025-10-30 17:22:54
Drupal JSON Field is vulnerable to XSS
GitHub

drupal/json_field

< 1.5

2025-10-30 17:11:07
Drupal Plausible tracking is vulnerable to XSS
GitHub

drupal/plausible_tracking

< 1.0.2

2025-10-30 17:10:59
Drupal Acquia DAM allows Forceful Browsing
GitHub

drupal/acquia_dam

< 1.1.5

2025-10-30 17:06:31
Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass
GitHub

drupal/simple_oauth

>= 6.0.0, < 6.0.7

2025-10-30 17:06:21
Drupal CivicTheme Design System allows Cross-Site Scripting (XSS)
GitHub

drupal/civictheme

< 1.12.0

2025-10-30 17:06:13
Drupal CivicTheme Design System allows Forceful Browsing
GitHub

drupal/civictheme

< 1.12.0

2025-10-30 17:06:07
Drupal Umami Analytics allows Cross-Site Scripting (XSS)
GitHub

drupal/umami_analytics

< 1.0.1

2025-10-30 17:05:32
Drupal Currency allows Cross Site Request Forgery
GitHub

drupal/currency

< 3.5.0

2025-10-30 17:05:25
Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables
GitHub

drupal/reverse_proxy_header

< 1.1.2

2025-10-30 17:05:16
Drupal Access code allows Brute Force Attempts
GitHub

drupal/access_code

< 2.0.5

2025-10-30 17:05:07
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
GitHub

code16/sharp

< 9.11.1

2025-10-29 10:52:08
PrivateBin is missing HTML sanitization of attached filename in file size hint
GitHub

privatebin/privatebin

>= 1.7.7, < 2.0.2

2025-10-28 20:14:09
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3

2025-10-24 20:59:28
Moodle sends quiz-related messages to inactive/suspended users
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 20:59:23
Moodle exposed the names of hidden groups to users
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:59:13
Moodle has a time restriction bypass
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:58:54
Moodle's error handling leads to sensitive information disclosure
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 20:58:33
Moodle vulnerable to brute-force password guesses
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:58:13
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
GitHub

spiral/roadrunner

< 2025.1.0

2025-10-24 20:57:41
Moodle does not properly enforce MFA
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 17:43:17
Magento Improper Access Control Leads to Privilege escalation
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:23
Magento Improper Authorization leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:18
Magento Improper Authorization leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:15
Magento Improper Authorization Leading to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:00
Magento Improper Access Control Leads to Privilege escalation
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:55
Magento Improper Authorization leads to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:42
Magento does not properly protect credentials
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:10
Magento Improper Access Control leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:05
Magento Improper Access Control leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 20:49:34
Magento Improper Access Control leads to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:28
Magento Improper Authorization leading to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:23
Magento Authenticated Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:18
Magento Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:04:01
Magento Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 20:55:36
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 20:53:37
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
GitHub

admidio/admidio

<= 4.3.16

2025-10-22 16:46:05
code16 Sharp vulnerable to Cross Site Scripting (XSS)
GitHub

code16/sharp

< 9.7.0

2025-10-21 22:22:39
Magento vulnerable to path traversal
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:37:11
Magento has incorrect authorization issue that leads to arbitrary file system read
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:37:01
Magento vulnerable to denial of service
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:27:52
Magento vulnerable to stored Cross-Site Scripting (XSS)
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 21:04:39
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service
GitHub

processwire/processwire

<= 3.0.246

2025-10-21 21:04:23
Magento vulnerable to stored Cross-Site Scripting (XSS)
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:57:35
Magento vulnerable to privilege escalation due to incorrect authorization
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:49:44
Magento provides incorrect authorization through a security feature bypass
GitHub

magento/community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:35:58
Shopware Customer Orders can be canceled, even if refunds are disabled
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:03:28
Shopware exposes sensitive user information via CSV export mapping
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:03:17
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:02:53
« Previous Next »

Showing 501 to 550 of 6751 results

1 2 ... 8 9 10 11 12 13 14 ... 135 136