Advisories

Listing reported advisories sorted by their report date.

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
GitHub

getkirby/cms

>= 5.0.0, < 5.4.0 · < 4.9.0

2026-04-24 20:39:37
TYPO3 CMS Stores Cleartext Password in User Settings Module
GitHub

typo3/cms-backend

= 14.2.0

2026-04-24 16:39:15
Kimai has Missing Object-Level Authorization in the Team API
GitHub

kimai/kimai

< 2.54.0

2026-04-24 16:17:37
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
GitHub

almirhodzic/nova-toggle-5

< 1.3.0

2026-04-24 16:00:10
Cockpit has NoSQL Injection Through Content Aggregation Pipelines
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-04-23 21:47:56
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
GitHub

getkirby/cms

>= 5.0.0, < 5.4.0 · < 4.9.0

2026-04-23 21:25:00
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
GitHub

getkirby/cms

>= 5.0.0, < 5.4.0 · < 4.9.0

2026-04-23 21:24:00
Kirby has XML injection in its XML creator toolkit
GitHub

getkirby/cms

>= 5.0.0, < 5.4.0 · < 4.9.0

2026-04-23 21:21:19
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
GitHub

flarum/core

>= 2.0.0-beta.1, <= 2.0.0-beta.8 · <= 1.8.15

2026-04-22 20:34:53
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
GitHub

ci4-cms-erp/ci4ms

< 0.31.5.0

2026-04-22 17:30:00
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
GitHub

ci4-cms-erp/ci4ms

< 0.31.5.0

2026-04-22 17:28:40
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
GitHub

ci4-cms-erp/ci4ms

< 0.31.5.0

2026-04-22 17:27:47
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
GitHub

phpunit/phpunit

>= 12.5.21, < 12.5.22 · >= 13.1.5, < 13.1.6

2026-04-22 14:56:08
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
GitHub

openmage/magento-lts

<= 20.16.0

2026-04-21 18:53:16
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
GitHub

october/system

>= 4.0.0, < 4.1.16 · < 3.7.16

2026-04-21 17:15:39
October CMS: Reflected XSS via DataTable Form Widget
GitHub

october/system

>= 4.0.0, < 4.1.16 · < 3.7.16

2026-04-21 17:15:22
October CMS has Safe Mode Bypass via Twig Database Write Operations
GitHub

october/october

>= 4.0.0, < 4.1.10 · < 3.7.14

2026-04-21 16:44:24
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
GitHub

october/system

>= 4.0.0, < 4.1.10 · < 3.7.14

2026-04-21 16:43:50
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
GitHub

openmage/magento-lts

< 20.17.0

2026-04-21 15:20:42
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
GitHub

openmage/magento-lts

< 20.17.0

2026-04-21 14:35:03
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
GitHub

openmage/magento-lts

< 20.17.0

2026-04-21 14:32:50
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
GitHub

phpunit/phpunit

>= 13.0.0, <= 13.1.5 · <= 12.5.21 · = 12.5.21 · = 13.1.5

2026-04-20 18:58:43
Craftql vulnerable to Server-Side Request Forgery
GitHub

markhuot/craftql

<= 1.3.7

2026-04-18 01:03:38
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
GitHub

dolibarr/dolibarr

<= 8.0.4

2026-04-18 01:01:27
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
GitHub

yeswiki/yeswiki

<= 4.6.0

2026-04-18 01:00:32
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
GitHub

studio-42/elfinder

< 2.1.67

2026-04-17 22:33:55
Kimai: Username enumeration via timing on X-AUTH-USER
GitHub

kimai/kimai

<= 2.53.0

2026-04-17 22:31:00
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
GitHub

dolibarr/dolibarr

<= 22.0.4

2026-04-17 21:24:50
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
GitHub

goodoneuz/pay-uz

<= 2.2.24

2026-04-16 22:58:59
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
GitHub

processwire/processwire

<= 3.0.255

2026-04-16 22:28:25
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar
GitHub

joedolson/my-calendar

< 3.7.7

2026-04-16 21:34:41
Statamic: Unsafe method invocation via query value resolution allows data destruction
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.13.0 · < 5.73.20

2026-04-16 21:25:35
WWBN AVideo: RCE cause by clonesite plugin
GitHub

wwbn/avideo

<= 29.0

2026-04-16 21:25:20
Silverstripe Assets Module has a DBFile::getURL() permission bypass
GitHub

silverstripe/assets

>= 3.0.0, < 3.1.3 · < 2.4.5

2026-04-16 20:40:39
CVE-2026-24749 - DBFile permission bypass
FriendsOfPHP

silverstripe/assets

>=3.0.0, <3.1.3 · >=2.0.0, <2.4.5

2026-04-16 02:30:38
Nodcms contains a cross-site request forgery vulnerability
GitHub

khodakhah/nodcms

<= 3.4.1

2026-04-16 01:34:09
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
GitHub

krayin/laravel-crm

<= 2.2.0

2026-04-16 01:32:30
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
GitHub

krayin/laravel-crm

<= 2.2.0

2026-04-16 01:32:20
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
GitHub

krayin/laravel-crm

<= 2.2.0

2026-04-16 01:31:49
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
GitHub

krayin/laravel-crm

<= 2.2.0

2026-04-16 01:31:39
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution
GitHub

froxlor/froxlor

<= 2.3.5

2026-04-16 01:02:16
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
GitHub

froxlor/froxlor

<= 2.3.5

2026-04-16 00:50:01
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:27
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:18
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:07
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
GitHub

froxlor/froxlor

<= 2.3.5

2026-04-16 00:46:47
Composer has a command injection via malicious perforce repository
GitHub

composer/composer

>= 2.0.0, < 2.2.27 · >= 1.0.0, < 2.2.27 · >= 2.3.0, < 2.9.6

2026-04-15 21:08:14
Composer has a command injection via malicious perforce reference
GitHub

composer/composer

>= 2.0.0, < 2.2.27 · >= 1.0.0, < 2.2.27 · >= 2.3.0, < 2.9.6

2026-04-15 21:08:04
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
GitHub

kimai/kimai

<= 2.52.0

2026-04-15 19:46:46
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
GitHub

kimai/kimai

< 2.53.0

2026-04-15 19:46:36
« Previous Next »

Showing 351 to 400 of 7292 results

1 2 ... 5 6 7 8 9 10 11 ... 145 146