Advisories

Listing reported advisories sorted by their report date.

phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
GitHub

phpseclib/phpseclib

>= 3.0.0, <= 3.0.49 · >= 2.0.0, <= 2.0.51 · <= 1.0.26

2026-03-19 16:42:22
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
GitHub

wwbn/avideo

<= 25.0

2026-03-19 12:46:02
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
GitHub

wwbn/avideo

<= 25.0

2026-03-19 12:45:38
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
GitHub

wwbn/avideo

<= 14.0

2026-03-19 12:43:43
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
GitHub

wwbn/avideo

<= 14.0

2026-03-19 12:43:24
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
GitHub

kelvinmo/simplejwt

<= 1.1.0

2026-03-18 20:16:59
Filament Unvalidated Range and Values summarizer values can be used for XSS
GitHub

filament/tables

>= 5.0.0, < 5.3.5 · >= 4.0.0, < 4.8.5

2026-03-18 20:07:25
Statamic is missing authorization check on taxonomy term creation via fieldtype
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.0 · < 5.73.14

2026-03-18 20:00:53
Statamic has a path traversal in file dictionary fieldtype
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.0 · < 5.73.14

2026-03-18 20:00:43
Statamic has Stored XSS via SVG Sanitization Bypass
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.0 · < 5.73.14

2026-03-18 19:54:32
Broken Access Control in extension "Redirect Tab" (redirect_tab)
GitHub

ayacoo/redirect-tab

>= 4.0.0, < 4.0.5 · >= 3.0.0, < 3.1.7 · < 2.1.2

2026-03-18 16:17:17
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
GitHub

cpsit/typo3-mailqueue

>= 0.5.0, < 0.5.2 · < 0.4.5

2026-03-18 16:17:11
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
GitHub

craftcms/cms

>= 5.9.0-beta.1, <= 5.9.10

2026-03-18 12:58:25
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
GitHub

wwbn/avideo

<= 25.0

2026-03-17 20:33:07
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler
GitHub

aureuserp/aureuserp

< 1.3.0-BETA1

2026-03-17 20:05:42
Unauthenticated Reflected XSS via innerHTML in AVideo
GitHub

wwbn/avideo

<= 25.0

2026-03-17 20:05:24
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
GitHub

wwbn/avideo

<= 25.0

2026-03-17 19:52:30
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
GitHub

wwbn/avideo

<= 25.0

2026-03-17 19:48:36
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
GitHub

wwbn/avideo

<= 25.0

2026-03-17 19:46:41
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
GitHub

cockpit-hq/cockpit

< 2.13.5

2026-03-17 17:07:43
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
GitHub

admidio/admidio

<= 5.0.6

2026-03-16 21:19:11
Admidio is Missing Authorization on Forum Topic and Post Deletion
GitHub

admidio/admidio

>= 5.0.0, <= 5.0.6

2026-03-16 21:18:55
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
GitHub

admidio/admidio

<= 5.0.6

2026-03-16 21:18:40
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
GitHub

admidio/admidio

>= 5.0.0, <= 5.0.6

2026-03-16 21:18:10
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
GitHub

admidio/admidio

>= 5.0.0, <= 5.0.6

2026-03-16 21:18:00
Admidio is Missing CSRF Protection on Role Membership Date Changes
GitHub

admidio/admidio

<= 5.0.6

2026-03-16 21:17:35
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
GitHub

admidio/admidio

>= 5.0.0, <= 5.0.6

2026-03-16 21:17:10
File Upload(RCE) Vulnerability in admidio
GitHub

admidio/admidio

<= 5.0.6

2026-03-16 21:16:50
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
GitHub

craftcms/azure-blob

>= 2.0.0-beta.1, <= 2.1.0

2026-03-16 18:44:41
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.11 · >= 4.0.0-RC1, <= 4.17.5

2026-03-16 18:44:21
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
GitHub

craftcms/google-cloud

>= 2.0.0-beta.1, <= 2.2.0

2026-03-16 18:14:25
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
GitHub

craftcms/aws-s3

>= 2.0.2, <= 2.2.4

2026-03-16 18:13:35
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.10 · >= 4.0.0-RC1, <= 4.17.4

2026-03-16 18:13:15
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
GitHub

craftcms/cms

>= 5.6.0, <= 5.9.10

2026-03-16 18:12:35
Craft CMS has a Path Traversal Vulnerability in AssetsController
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.10 · >= 4.0.0-RC1, <= 4.17.4

2026-03-16 18:11:50
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
GitHub

craftcms/webhooks

>= 3.0.0, < 3.2.0

2026-03-16 18:11:25
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
GitHub

simplesamlphp/xml-security

>= 2.0.0, < 2.3.1 · < 1.13.9 · < 2.3.1

2026-03-16 12:28:23
Statamic vulnerable to privilege escalation via stored cross-site scripting
GitHub

statamic/cms

>= 6.0.0, < 6.6.2

2026-03-13 20:50:55
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
GitHub

robrichards/xmlseclibs

< 3.1.5

2026-03-13 20:04:25
Winter vulnerable to privilege escalation by authenticated backend users
GitHub

winter/wn-backend-module

>= 1.2.0, < 1.2.12 · >= 1.1.0, < 1.1.12 · < 1.0.477

2026-03-12 14:07:39
LimeSurvey is vulnerable to SQL injection
GitHub

limesurvey/limesurvey

< 6.15.4

2026-03-11 21:11:55
Shopware vulnerable to a potential take over of app credentials
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.8.1 · < 6.6.10.15

2026-03-11 19:24:07
Shopware has user enumeration via distinct error codes on Store API login endpoint
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.8.1 · < 6.6.10.15 · < 6.6.10.14

2026-03-11 19:23:50
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
GitHub

shopware/core

>= 6.7.0.0, < 6.7.8.1 · < 6.6.10.15

2026-03-11 19:23:44
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.21

2026-03-11 14:57:00
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
GitHub

craftcms/cms

>= 4.0.0-beta.1, <= 4.17.3 · >= 5.0.0-RC1, <= 5.9.8

2026-03-11 14:56:47
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.8

2026-03-11 00:27:24
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
GitHub

craftcms/cms

>= 4.15.3, <= 4.17.2 · >= 5.7.5, <= 5.9.6

2026-03-11 00:26:14
Sylius has a DQL Injection via API Order Filters
GitHub

sylius/sylius

>= 1.14.0, <= 1.14.17 · >= 1.13.0, <= 1.13.14 · >= 1.12.0, <= 1.12.22 · >= 1.11.0, <= 1.11.16 · >= 1.10.0, <= 1.10.15 · >= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2 · <= 1.9.11

2026-03-11 00:13:43
Sylius has a Promotion Usage Limit Bypass via Race Condition
GitHub

sylius/sylius

>= 1.14.0, <= 1.14.17 · >= 1.13.0, <= 1.13.14 · >= 1.12.0, <= 1.12.22 · >= 1.11.0, <= 1.11.16 · >= 1.10.0, <= 1.10.15 · >= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2 · <= 1.9.11

2026-03-11 00:13:33
« Previous Next »

Showing 101 to 150 of 6751 results

1 2 3 4 5 6 7 8 9 10 ... 135 136