Advisories

Listing reported advisories sorted by their report date.

CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/mailtrap-mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-20 08:00:00
CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/mailjet-mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-20 08:00:00
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
FriendsOfPHP

symfony/mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/lox24-notifier

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0

2026-05-20 08:00:00
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
FriendsOfPHP

symfony/json-path

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0

2026-05-20 08:00:00
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
FriendsOfPHP

symfony/http-kernel

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12

2026-05-20 08:00:00
CVE-2026-45753: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-20 08:00:00
CVE-2026-45066: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-20 08:00:00
CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-20 08:00:00
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
FriendsOfPHP

symfony/dom-crawler

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
FriendsOfPHP

symfony/cache

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
GitHub

setasign/fpdi

< 2.6.7

2026-05-19 19:56:20
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
GitHub

WWBN/AVideo

<= 29.0

2026-05-19 16:25:28
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
GitHub

composer/composer

>= 2.0.0, < 2.2.28 · >= 2.3.0, < 2.9.8 · >= 1.0, < 1.10.28

2026-05-19 16:17:59
SQL Injection in extension "News system" (news)
FriendsOfPHP

georgringer/news

>=14.0.0, <14.0.3 · >=13.0.0, <13.0.2 · >=12.0.0, <12.3.2 · <11.4.4

2026-05-19 12:00:00
AVideo: Authenticated Arbitrary File Read in view/update.php
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 19:01:59
TYPO3-EXT-SA-2026-008: Remote Code Execution in extension "Site Crawler" (crawler)
FriendsOfPHP

tomasnorre/crawler

>=12.0.0, <12.0.11 · <11.0.13

2026-05-18 17:48:41
Sulu: Used API Keys may be available via Admin API
GitHub

sulu/sulu

>= 3.0.0-alpha1, <= 3.0.5 · <= 2.6.22

2026-05-18 17:34:07
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
GitHub

sulu/sulu

>= 3.0.0-alpha1, <= 3.0.5 · <= 2.6.22

2026-05-18 17:27:22
Formie: Pre-authenticated server-side template injection in Hidden fields
GitHub

verbb/formie

>= 3.0.0-beta.1, < 3.1.24 · < 2.2.20

2026-05-18 17:23:40
LibreNMS: Cross-Site Scripting in ShowConfigController
GitHub

librenms/librenms

>= 25.12.0, < 26.3.0

2026-05-18 17:00:49
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
FriendsOfPHP

evoweb/sf-register

>=14.0.0, <14.0.2 · <13.2.4

2026-05-18 16:44:09
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
GitHub

shopper/cart

< 2.8.0

2026-05-18 16:37:21
shopper/framework: Authorization bypass in multiple Livewire admin components
GitHub

shopper/framework

< 2.8.0

2026-05-18 16:34:25
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 16:23:35
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 16:21:18
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 15:39:34
Statamic CMS: Server-Side Request Forgery via Glide
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.18.1 · < 5.73.22

2026-05-18 15:32:44
TYPO3-EXT-SA-2026-012: SQL Injection in extension "Address List" (tt_address)
FriendsOfPHP

friendsoftypo3/tt-address

>=10.0.0, <10.0.1 · >=9.0.0, <9.1.1 · <8.1.2

2026-05-18 15:27:01
TYPO3-EXT-SA-2026-011: Information Disclosure in extension "Faceted Search" (ke_search)
FriendsOfPHP

tpwd/ke_search

>=7.0.0, <7.0.1 · >=6.0.0, <6.6.1 · <5.6.2

2026-05-18 14:42:46
TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)
FriendsOfPHP

tpwd/ke_search

>=7.0.0, <7.0.1 · >=6.0.0, <6.6.1 · <5.6.2

2026-05-18 14:42:46
TYPO3-EXT-SA-2026-011: XML External Entity Injection in extension "Faceted Search" (ke_search)
FriendsOfPHP

tpwd/ke_search

>=7.0.0, <7.0.1 · >=6.0.0, <6.6.1 · <5.6.2

2026-05-18 14:42:46
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 13:30:05
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:42
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:02
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:34:01
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:32:37
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:17:21
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
GitHub

simplesamlphp/simplesamlphp-module-casserver

<= 7.0.2

2026-05-15 18:07:51
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
GitHub

code16/sharp

< 9.22.0

2026-05-15 18:01:05
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
GitHub

nukeviet/nukeviet

<= 4.4.01

2026-05-15 16:45:04
SimpleSAMLphp casserver: Open Redirect in logout
GitHub

simplesamlphp/simplesamlphp-module-casserver

>= 7.0.0-rc1, < 7.0.0-rc3 · < 6.3.1

2026-05-15 16:21:14
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
GitHub

coreshop/core-shop

= 5.0.0

2026-05-14 13:18:17
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
GitHub

getgrav/grav

<= 2.0.0-rc.1

2026-05-13 15:29:43
TorrentPier Deserialization of Untrusted Data vulnerability
GitHub

torrentpier/torrentpier

<= 2.4.3

2026-05-13 13:37:03
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
GitHub

torrentpier/torrentpier

<= 2.8.8

2026-05-13 13:36:18
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
GitHub

krayin/laravel-crm

= 2.1.5

2026-05-12 16:20:23
MantisBT Vulnerable to Stored XSS in File Download
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:40:48
MantisBT has Stored XSS on Move Attachments Admin Page
GitHub

mantisbt/mantisbt

>= 1.3.0, <= 2.28.1

2026-05-11 19:40:33
MantisBT has a Private Bugnote Attachment Content Leak via REST API
GitHub

mantisbt/mantisbt

>= 2.23.0, <= 2.28.1

2026-05-11 19:39:47
« Previous Next »

Showing 151 to 200 of 7292 results

1 2 3 4 5 6 7 8 9 10 ... 145 146