Advisories

Listing reported advisories sorted by their report date.

PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
GitHub

pocketmine/pocketmine-mp

< 5.42.1

2026-04-15 19:43:34
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.14 · >= 4.0.0-RC1, <= 4.17.8

2026-04-14 23:36:11
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.14 · >= 4.0.0-RC1, <= 4.17.8

2026-04-14 23:35:16
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
GitHub

craftcms/cms

>= 5.6.0, < 5.9.15

2026-04-14 23:34:53
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:27:20
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:25:30
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:23:15
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:24
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:04
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:21:34
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:30
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:19
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:15:44
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:22
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:09
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:54
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:40
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:31
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:50:07
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:48
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:27
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:06
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
GitHub

s9y/serendipity

< 2.6.0

2026-04-14 22:32:40
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
GitHub

s9y/serendipity

< 2.6.0

2026-04-14 22:32:30
October Rain has Stored XSS via SVG Filter Bypass
GitHub

october/rain

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 22:29:51
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
GitHub

october/rain

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 22:29:43
October CMS has Stored XSS in Event Log Mail Preview
GitHub

october/system

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 20:02:51
October CMS has Stored XSS in Backend Editor Markup Classes
GitHub

october/system

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 20:02:33
October Rain has a Twig Sandbox Bypass via Collection Methods
GitHub

october/rain

>= 4.0.0, <= 4.1.4 · <= 3.7.12

2026-04-14 20:02:06
Kimai leaks API Token Hash via Invoice Twig Template
GitHub

kimai/kimai

<= 2.52.0

2026-04-14 01:06:27
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler
GitHub

kimai/kimai

<= 2.52.0

2026-04-14 01:06:07
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
GitHub

webonyx/graphql-php

<= 15.31.4

2026-04-14 01:05:07
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.2 · >= 5.0.0, <= 5.5.4

2026-04-14 01:01:21
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.2 · >= 5.0.0, <= 5.5.4

2026-04-14 00:07:35
Craft Commerce hasVariant/hasProduct Blind SQL Injection
GitHub

craftcms/commerce

>= 5.0.0, < 5.6.0

2026-04-14 00:06:57
Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
GitHub

laravel/passport

>= 13.0.0, < 13.7.1 · < 13.7.1

2026-04-13 17:48:47
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:41:30
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:40:21
Potential XSS vulnerability in jQuery
GitHub

maximebf/debugbar

>= 1.12.0, < 3.5.0 · >= 1.2.0, < 3.5.0 · <= 4.0.0 · < 1.19.0

2026-04-13 13:46:46
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
GitHub

rhukster/dom-sanitizer

< 1.0.10

2026-04-10 21:08:31
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
GitHub

redaxo/source

< 5.21.0

2026-04-10 19:40:45
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
GitHub

redaxo/source

< 5.21.0

2026-04-10 19:40:25
yaffa vulnerable to Cross Site Scripting
GitHub

kantorge/yaffa

<= 2.0.0

2026-04-10 14:10:58
TYPO3-EXT-SA-2026-013: Remote Code Execution in extension "Content Element Selector" (ceselector)
FriendsOfPHP

mmc/ceselector

>=6.0.0, <6.0.1 · >=5.0.0, <5.0.1 · >=4.0.0, <4.0.2 · <3.0.3

2026-04-09 22:34:39
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
GitHub

wwbn/avideo

<= 26.0 · <= 14.3

2026-04-08 23:16:01
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
GitHub

wwbn/avideo

<= 26.0

2026-04-08 22:49:57
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
GitHub

ci4-cms-erp/ci4ms

<= 0.31.3.0

2026-04-08 19:16:14
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
GitHub

ci4-cms-erp/ci4ms

<= 0.31.3.0

2026-04-08 19:15:59
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
GitHub

ci4-cms-erp/ci4ms

<= 0.31.3.0

2026-04-08 19:15:44
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
GitHub

ci4-cms-erp/ci4ms

<= 0.31.3.0

2026-04-08 19:15:34
« Previous Next »

Showing 401 to 450 of 7292 results

1 2 ... 6 7 8 9 10 11 12 ... 145 146