Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-26 23:49:56
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
GitHub

getkirby/cms

>= 5.0.0, <= 5.4.0 · <= 4.9.0

2026-05-26 23:47:20
Pterodactyl has a database resource limit bypass via race condition in Client API
GitHub

pterodactyl/panel

< 1.12.3

2026-05-26 19:30:04
YesWiki: Unauthenticated SQL Injection
GitHub

yeswiki/yeswiki

< 4.6.4

2026-05-22 15:39:07
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
GitHub

twig/twig

>= 3.15.0, < 3.26.0

2026-05-21 21:31:09
Twig: Sandbox property and method bypass via object-destructuring assignment
GitHub

twig/twig

>= 3.24.0, < 3.26.0

2026-05-21 21:30:50
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:28:28
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
GitHub

twig/markdown-extra

< 3.26.0

2026-05-21 21:27:21
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
GitHub

twig/twig

< 3.26.0

2026-05-21 21:25:56
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
GitHub

twig/twig

>= 3.9.0, < 3.26.0

2026-05-21 21:25:13
Twig: PHP code injection via `{% use %}` template name
GitHub

twig/twig

< 3.26.0

2026-05-21 21:24:54
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
GitHub

twig/intl-extra

< 3.26.0

2026-05-21 21:23:53
Twig: The `spaceless` filter implicitly marks its output as safe
GitHub

twig/twig

< 3.26.0

2026-05-21 21:21:37
phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:46
phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:35
phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:41
phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:26
phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:12:40
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 20:53:54
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
GitHub

cockpit-hq/cockpit

<= 2.14.0

2026-05-21 20:26:50
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
GitHub

KnpLabs/knp-snappy

<= 1.7.0

2026-05-21 20:22:18
Snappy : SSRF and local file read via the xsl-style-sheet option
GitHub

knplabs/knp-snappy

<= 1.6.0

2026-05-21 20:20:02
hjson stack exhaustion vulnerability
GitHub

laktak/hjson

< 2.3.0

2026-05-20 22:35:10
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:46:55
phpMyFAQ: Default Empty API Token Authentication Bypass
GitHub

thorsten/phpmyfaq

<= 4.1.2

2026-05-20 15:46:44
phpMyFAQ: IDOR Account Takeover
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:46:18
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
GitHub

thorsten/phpmyfaq

< 4.1.3

2026-05-20 15:45:53
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
GitHub

setasign/fpdi

< 2.6.7

2026-05-19 19:56:20
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
GitHub

WWBN/AVideo

<= 29.0

2026-05-19 16:25:28
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
GitHub

composer/composer

>= 2.0.0, < 2.2.28 · >= 2.3.0, < 2.9.8 · >= 1.0, < 1.10.28

2026-05-19 16:17:59
AVideo: Authenticated Arbitrary File Read in view/update.php
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 19:01:59
Sulu: Used API Keys may be available via Admin API
GitHub

sulu/sulu

>= 3.0.0-alpha1, <= 3.0.5 · <= 2.6.22

2026-05-18 17:34:07
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
GitHub

sulu/sulu

>= 3.0.0-alpha1, <= 3.0.5 · <= 2.6.22

2026-05-18 17:27:22
Formie: Pre-authenticated server-side template injection in Hidden fields
GitHub

verbb/formie

>= 3.0.0-beta.1, < 3.1.24 · < 2.2.20

2026-05-18 17:23:40
LibreNMS: Cross-Site Scripting in ShowConfigController
GitHub

librenms/librenms

>= 25.12.0, < 26.3.0

2026-05-18 17:00:49
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
GitHub

shopper/cart

< 2.8.0

2026-05-18 16:37:21
shopper/framework: Authorization bypass in multiple Livewire admin components
GitHub

shopper/framework

< 2.8.0

2026-05-18 16:34:25
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 16:23:35
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 16:21:18
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
GitHub

ci4-cms-erp/ci4ms

<= 0.31.8.0

2026-05-18 15:39:34
Statamic CMS: Server-Side Request Forgery via Glide
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.18.1 · < 5.73.22

2026-05-18 15:32:44
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 13:30:05
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:42
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:02
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:34:01
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:32:37
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:17:21
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
GitHub

simplesamlphp/simplesamlphp-module-casserver

<= 7.0.2

2026-05-15 18:07:51
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
GitHub

code16/sharp

< 9.22.0

2026-05-15 18:01:05
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
GitHub

nukeviet/nukeviet

<= 4.4.01

2026-05-15 16:45:04
« Previous Next »

Showing 51 to 100 of 5833 results

1 2 3 4 5 6 7 8 9 10 ... 116 117