Advisories

Listing reported advisories sorted by their report date.

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:39:32
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
GitHub

mantisbt/mantisbt

>= 1.0.0, < 2.28.2

2026-05-11 19:39:23
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
GitHub

mantisbt/mantisbt

>= 2.1.0, <= 2.28.1

2026-05-11 19:35:07
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:35:02
MantisBT has a Content Security Policy bypass via attachments
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:34:52
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
GitHub

mantisbt/mantisbt

>= 2.11.0, <= 2.28.1

2026-05-11 19:34:42
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:34:33
Yii 2: Local file inclusion via view parameter name collision
GitHub

yiisoft/yii2

< 2.0.55

2026-05-11 19:34:32
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:33:12
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:33:07
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:32:37
MantisBT has an authorization bypass in private issue monitoring
GitHub

mantisbt/mantisbt

>= 2.26.1, <= 2.28.1

2026-05-11 19:32:27
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:32:12
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
GitHub

mantisbt/mantisbt

<= 2.28.1

2026-05-11 19:32:06
MantisBT Has Authorization Bypass in Global Profile Creation
GitHub

mantisbt/mantisbt

>= 2.28.0, < 2.28.2

2026-05-11 17:58:54
torrentpier has PHP Serialize Injections
GitHub

torrentpier/torrentpier

<= 2.4.3

2026-05-11 17:53:23
Dolibarr has an Injection issue
GitHub

dolibarr/dolibarr

<= 23.0.2

2026-05-11 16:21:37
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
GitHub

studio-42/elfinder

<= 2.1.67

2026-05-11 16:11:32
Snipe-IT has an open redirect vulnerability
GitHub

snipe/snipe-it

< 8.4.1

2026-05-08 23:25:38
Phpseclib needs guardrails on large binaryfield integers
GitHub

phpseclib/phpseclib

>= 3.0.0, < 3.0.34

2026-05-08 23:06:50
Snipe-IT has insecure permissions in file uploads
GitHub

snipe/snipe-it

< 8.4.1

2026-05-08 23:04:36
Snipe-IT has Privilege Escalation via API Permissions Assignment
GitHub

snipe/snipe-it

< 8.4.1

2026-05-08 22:24:47
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)
GitHub

snipe/snipe-it

< 8.4.1

2026-05-08 22:23:42
Kimai has an arbitrary file read in its invoice PDF renderer (admin)
GitHub

kimai/kimai

>= 2.32.0, <= 2.55

2026-05-08 22:22:38
Grav: Stored XSS via page title (data[header][title]) in admin panel
GitHub

getgrav/grav

< 1.7.49.5

2026-05-08 19:38:02
OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality
GitHub

devcode-it/openstamanager

<= 2.10-beta

2026-05-08 18:49:58
phpseclib guardrails needed on OID length
GitHub

phpseclib/phpseclib

>= 3.0.0, <= 3.0.35 · >= 2.0.0, <= 2.0.46 · >= 0.1.1, <= 1.0.22

2026-05-08 18:24:30
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
GitHub

phpseclib/phpseclib

>= 0.0.11, <= 1.0.28 · >= 3.0.0, <= 3.0.51 · >= 2.0.0, <= 2.0.53 · >= 0.1.1, <= 1.0.28

2026-05-08 18:13:53
PrestaShop has a stored XSS executable in customer service view
GitHub

prestashop/prestashop

>= 9.0.0, < 9.1.1 · < 8.2.6

2026-05-08 16:54:23
Funadmin has an Improper Access Control Issue
GitHub

funadmin/funadmin

<= 7.1.0-rc6

2026-05-08 16:38:10
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
GitHub

phpseclib/phpseclib

>= 3.0.0, <= 3.0.49 · >= 2.0.0, <= 2.0.51 · >= 0.1.1, <= 1.0.26 · <= 1.0.26

2026-05-08 15:18:14
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
GitHub

phpseclib/phpseclib

>= 3.0.0, < 3.0.51 · >= 2.0.0, < 2.0.53 · >= 0.1.1, < 1.0.28 · < 1.0.28

2026-05-08 15:17:49
Dolibarr has Insufficient Verification of Data Authenticity
GitHub

dolibarr/dolibarr

<= 15.0.3

2026-05-07 22:30:08
Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy
GitHub

web-auth/webauthn-framework

>= 5.3.0, < 5.3.1

2026-05-07 21:05:34
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
GitHub

facturascripts/facturascripts

<= 2025.81

2026-05-07 19:49:06
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
GitHub

facturascripts/facturascripts

>= 2026, <= 2026.1

2026-05-07 19:43:25
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
GitHub

facturascripts/facturascripts

<= 2025.92

2026-05-07 19:37:10
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
GitHub

facturascripts/facturascripts

<= 2025.71

2026-05-07 19:34:29
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
GitHub

facturascripts/facturascripts

<= 2025.81

2026-05-07 19:33:49
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
GitHub

facturascripts/facturascripts

<= 2025.71

2026-05-07 19:32:14
Compromised tag of intercom-php published via GitHub
GitHub

intercom/intercom-php

= 5.0.2

2026-05-07 16:48:42
MixPHP Framework has an SQL injection vulnerability via crafted `data` array
GitHub

mix/mix

>= 2.0.0, <= 2.2.17

2026-05-07 16:45:31
MixPHP Framework has an SQL injection vulnerability
GitHub

mix/mix

>= 2.0.0, <= 2.2.17

2026-05-07 16:44:59
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
GitHub

krayin/laravel-crm

= 2.1.5

2026-05-07 01:16:53
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 23:11:17
Cockpit is vulnerable to directory traversal
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 23:05:00
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
GitHub

getgrav/grav-plugin-form

< 9.1.0

2026-05-06 23:03:14
Cockpit is vulnerable to arbitrary code execution
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 22:57:18
Bagisto affected by Server-Side Request Forgery
GitHub

bagisto/bagisto

<= 2.3.15

2026-05-06 22:07:41
Bagisto affected by Cross-site Scripting
GitHub

bagisto/bagisto

<= 2.3.15

2026-05-06 22:07:14
« Previous Next »

Showing 201 to 250 of 7292 results

1 2 3 4 5 6 7 8 9 10 ... 145 146