Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

MixPHP Framework has an SQL injection vulnerability via crafted `data` array
GitHub

mix/mix

>= 2.0.0, <= 2.2.17

2026-05-07 16:45:31
MixPHP Framework has an SQL injection vulnerability
GitHub

mix/mix

>= 2.0.0, <= 2.2.17

2026-05-07 16:44:59
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
GitHub

krayin/laravel-crm

= 2.1.5

2026-05-07 01:16:53
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 23:11:17
Cockpit is vulnerable to directory traversal
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 23:05:00
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
GitHub

getgrav/grav-plugin-form

< 9.1.0

2026-05-06 23:03:14
Cockpit is vulnerable to arbitrary code execution
GitHub

cockpit-hq/cockpit

< 2.14.0

2026-05-06 22:57:18
Bagisto affected by Server-Side Request Forgery
GitHub

bagisto/bagisto

<= 2.3.15

2026-05-06 22:07:41
Bagisto affected by Cross-site Scripting
GitHub

bagisto/bagisto

<= 2.3.15

2026-05-06 22:07:14
Flight vulnerable to sensitive information disclosure via default error handler
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:39:11
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:38:16
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:36:19
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:34:40
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:34:15
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
GitHub

getgrav/grav

< 2.0.0-beta.4

2026-05-06 21:19:23
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
GitHub

openmage/magento-lts

<= 20.17.0

2026-05-06 20:57:38
Statamic CMS vulnerable to email enumeration via forgot password endpoint
GitHub

statamic/cms

>= 6.0.0, < 6.15.0 · < 5.73.21

2026-05-06 20:54:32
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:49:15
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:47:55
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:45:02
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:44:39
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:42:55
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
GitHub

thorsten/phpmyfaq

= 4.1.1

2026-05-06 20:37:43
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:31:56
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
GitHub

thorsten/phpmyfaq

<= 4.1.1

2026-05-06 20:24:40
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:18:50
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:18:05
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:12:09
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:11:54
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
GitHub

thorsten/phpmyfaq

= 4.1.1

2026-05-06 20:10:49
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
GitHub

dedoc/scramble

>= 0.13.2, <= 0.13.21

2026-05-06 19:54:57
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
GitHub

kimai/kimai

<= 2.55.0

2026-05-06 18:42:31
Pimcore has an authenticated Cross-site Scripting issue
GitHub

pimcore/pimcore

= 12.3.3

2026-05-06 18:40:18
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation
GitHub

kimai/kimai

<= 2.55.0

2026-05-06 18:28:46
phpseclib: guardrails needed on isPrime and randomPrime
GitHub

phpseclib/phpseclib

>= 3.0.0, < 3.0.36 · >= 2.0.0, < 2.0.47 · >= 0.1.1, < 1.0.23

2026-05-06 17:57:11
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
GitHub

craftcms/cms

>= 5.0.0-RC1, < 5.9.18

2026-05-06 17:54:48
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
GitHub

craftcms/cms

>= 4.0.0, < 4.17.12 · >= 5.0.0, < 5.9.18

2026-05-06 17:54:06
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
GitHub

craftcms/cms

>= 4.0.0, < 4.17.12 · >= 5.0.0, < 5.9.18

2026-05-06 17:49:19
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:20:43
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:16:34
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:16:13
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:14:33
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:02:37
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
GitHub

wwbn/avideo

<= 29.0

2026-05-05 21:56:21
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
GitHub

wwbn/avideo

<= 29.0

2026-05-05 21:49:25
Grav is Vulnerable to Stored XSS via Tag Injection
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:36:29
Grav is Vulnerable to XXE via SVG Upload
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:35:54
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:34:58
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:29:55
Grav has Insecure Deserialization in File Cache
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:29:30
« Previous Next »

Showing 151 to 200 of 5833 results

1 2 3 4 5 6 7 8 9 10 ... 116 117