Advisories

Listing reported advisories sorted by their report date.

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
GitHub

wwbn/avideo

<= 21.0.0

2026-03-02 20:49:46
Statamic vulnerable to privilege escalation via stored cross-site scripting
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.4.0 · < 5.73.11

2026-03-01 01:31:09
Statamic's missing authorization allows access to email addresses
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.4.0 · < 5.73.11

2026-03-01 01:30:44
Statamic Vulnerable to Server-Side Request Forgery via Glide
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.4.0 · < 5.73.11

2026-03-01 01:30:24
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
GitHub

statamic/cms

>= 6.0.0, < 6.4.0

2026-02-27 21:35:03
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
GitHub

thorsten/phpmyfaq

< 4.0.18

2026-02-27 21:01:58
funadmin: XSS through Value argument in Backend Interface component
GitHub

funadmin/funadmin

<= 7.1.0-rc4

2026-02-26 15:33:02
funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function
GitHub

funadmin/funadmin

<= 7.1.0-rc4

2026-02-26 15:33:00
funadmin has Incorrect Privilege Assignment in its Configuration Handler
GitHub

funadmin/funadmin

<= 7.1.0-rc4

2026-02-26 15:31:57
funadmin has Weak Password Recovery Mechanism for Forgotten Password
GitHub

funadmin/funadmin

<= 7.1.0-rc4

2026-02-26 15:31:42
funadmin exposes sensitive information via getMember function
GitHub

funadmin/funadmin

<= 7.1.0-rc4

2026-02-26 15:31:31
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
GitHub

mautic/core

>= 7.0.0-alpha, < 7.0.1 · >= 6.0.0-alpha, < 6.0.8 · >= 2.10.0, < 5.2.10

2026-02-25 19:28:40
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
GitHub

craftcms/cms

>= 4.5.0-beta.1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-25 19:11:33
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
GitHub

wwbn/avideo

<= 21.0.0

2026-02-25 18:57:07
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
GitHub

typicms/core

< 16.1.7

2026-02-25 16:07:00
Moodle has a Remote Code Execution risk via file restore
GitHub

moodle/moodle

>= 5.1.0-beta, < 5.1.2 · >= 5.0.0-beta, < 5.0.5 · < 4.5.9

2026-02-25 15:52:48
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits
GitHub

moodle/moodle

>= 5.1.0-beta, < 5.1.2 · >= 5.0.0-beta, < 5.0.5 · < 4.5.9

2026-02-25 15:51:01
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
GitHub

pimcore/pimcore

>= 12.0.0, < 12.3.3 · <= 11.5.14.1

2026-02-24 20:03:26
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.22 · >= 3.5.0, <= 4.16.18

2026-02-24 15:51:09
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
GitHub

craftcms/cms

>= 4.5.0-RC1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-23 22:16:24
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.22 · >= 3.5.0, <= 4.16.18

2026-02-23 22:16:04
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
GitHub

craftcms/cms

>= 4.5.0-RC1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-23 22:15:05
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
GitHub

wwbn/avideo

< 21.0

2026-02-20 21:15:07
Kimai contains a SameSite cookie vulnerability
GitHub

kimai/kimai

<= 1.30.10

2026-02-20 18:25:04
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
GitHub

zumba/json-serializer

< 3.2.3

2026-02-19 22:05:43
Formwork Improperly Managed Privileges in User creation
GitHub

getformwork/formwork

>= 2.0.0, <= 2.3.3

2026-02-19 20:31:12
Statamic affected by privilege escalation via stored cross-site scripting
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.3.2 · < 5.73.9

2026-02-19 20:30:39
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
GitHub

librenms/librenms

< 26.2.0

2026-02-18 22:31:38
LibreNMS has a Stored XSS in Alert Rule
GitHub

librenms/librenms

<= 25.12.0

2026-02-18 22:30:35
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
GitHub

librenms/librenms

< 26.2.0

2026-02-18 22:30:20
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()
GitHub

librenms/librenms

>= 24.10.0, < 26.2.0

2026-02-18 22:08:18
LibreNMS /port-groups name Stored Cross-Site Scripting
GitHub

librenms/librenms

< 26.2.0

2026-02-18 22:07:43
LibreNMS affected by reflected xss via email field
GitHub

librenms/librenms

< 26.2.0

2026-02-18 22:07:32
LibreNMS /device-groups name Stored Cross-Site Scripting
GitHub

librenms/librenms

< 26.2.0

2026-02-18 22:07:32
php-jwt contains weak encryption
GitHub

firebase/php-jwt

< 7.0.0

2026-02-18 00:55:51
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
GitHub

pterodactyl/panel

< 1.12.1

2026-02-17 18:54:50
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
GitHub

pterodactyl/panel

< 1.12.1

2026-02-17 17:15:19
ImapEngine affected by command injection via the ID command parameters
GitHub

directorytree/imapengine

< 1.22.3

2026-02-17 16:40:47
Known affected by Account Takeover via Password Reset Token Leakage
GitHub

idno/known

<= 1.6.2

2026-02-13 22:49:30
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
GitHub

cesargb/laravel-magiclink

>= 2.0.0, < 2.25.1

2026-02-12 22:12:39
Phraseanet vulnerable to stored cross-site scripting through crafted file names
GitHub

phraseanet/phraseanet

= 4.0.3

2026-02-11 18:39:49
Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions
GitHub

kimai/kimai

< 1.1

2026-02-11 18:39:12
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
GitHub

statamic/cms

>= 6.0.0, < 6.2.3

2026-02-11 18:17:59
Statamic CMS's missing authorization allows access to assets
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.2.5 · < 5.73.6

2026-02-11 16:53:40
amphp/http-server affected by HTTP/2 DDoS vulnerability
GitHub

amphp/http-server

>= 3.0.0-beta.1, < 3.4.4 · >= 2.0.0-rc1, < 2.1.10

2026-02-10 00:25:45
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
GitHub

vrana/adminer

>= 4.6.2, < 5.4.2

2026-02-10 00:25:25
FroshAdminer Adminer UI is accessible without admin session
GitHub

frosh/adminer-platform

< 2.2.1

2026-02-10 00:22:10
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:36:44
Craft CMS: GraphQL Asset Mutation Privilege Escalation
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-02-09 20:36:26
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:48
« Previous Next »

Showing 201 to 250 of 6751 results

1 2 3 4 5 6 7 8 9 10 ... 135 136