Advisories

Listing reported advisories sorted by their report date.

Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
GitHub

pimcore/admin-ui-classic-bundle

<= 2.3.5

2026-05-27 00:35:56
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
GitHub

pimcore/pimcore

<= 12.3.5

2026-05-27 00:35:05
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
GitHub

getkirby/cms

>= 5.3.0, <= 5.4.0

2026-05-26 23:56:41
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-26 23:55:36
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-26 23:49:56
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-26 23:47:20
Pterodactyl has a database resource limit bypass via race condition in Client API
GitHub

pterodactyl/panel

< 1.12.3

2026-05-26 19:30:04
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/security-http

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/routing

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/mailomat-mailer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-foundation

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=5.4.0, <5.4.53

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill

>=1.17.1, <1.38.1

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill-intl-idn

>=1.17.1, <1.38.1

2026-05-26 08:00:00
YesWiki: Unauthenticated SQL Injection
GitHub

yeswiki/yeswiki

< 4.6.4

2026-05-22 15:39:07
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
GitHub

twig/twig

>= 3.15.0, < 3.26.0

2026-05-21 21:31:09
Twig: Sandbox property and method bypass via object-destructuring assignment
GitHub

twig/twig

>= 3.24.0, < 3.26.0

2026-05-21 21:30:50
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:28:28
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
GitHub

twig/markdown-extra

< 3.26.0

2026-05-21 21:27:21
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:25:56
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
GitHub

twig/twig

>= 3.9.0, < 3.26.0

2026-05-21 21:25:13
Twig: PHP code injection via `{% use %}` template name
GitHub

twig/twig

< 3.26.0

2026-05-21 21:24:54
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
GitHub

twig/intl-extra

< 3.26.0

2026-05-21 21:23:53
Twig: The `spaceless` filter implicitly marks its output as safe
GitHub

twig/twig

< 3.26.0

2026-05-21 21:21:37
phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:46
phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:35
phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:41
phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:26
phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:12:40
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 20:53:54
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
GitHub

cockpit-hq/cockpit

<= 2.14.0

2026-05-21 20:26:50
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
GitHub

KnpLabs/knp-snappy

<= 1.7.0

2026-05-21 20:22:18
Snappy : SSRF and local file read via the xsl-style-sheet option
GitHub

knplabs/knp-snappy

<= 1.6.0

2026-05-21 20:20:02
hjson stack exhaustion vulnerability
GitHub

laktak/hjson

< 2.3.0

2026-05-20 22:35:10
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:46:55
phpMyFAQ: Default Empty API Token Authentication Bypass
GitHub

thorsten/phpmyfaq

<= 4.1.2

2026-05-20 15:46:44
phpMyFAQ: IDOR Account Takeover
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:46:18
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:45:53
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
XSS in profiler HtmlDumper via unescaped template and profile names
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0

2026-05-20 08:00:00
« Previous Next »

Showing 51 to 100 of 7292 results

1 2 3 4 5 6 7 8 9 10 ... 145 146