Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:29:03
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:27:16
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:26:46
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:26:07
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:24:46
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:24:09
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
GitHub

getgrav/grav

< 2.0.0-beta.2

2026-05-05 21:21:13
Grav API Privilege Escalation to Super Admin
GitHub

getgrav/grav-plugin-api

< 1.0.0-beta.15

2026-05-05 21:20:03
Kimai vulnerable to formula Injection via tag names in XLSX export
GitHub

kimai/kimai

>= 2.27.0, <= 2.53.0

2026-05-05 20:53:41
ShowDoc has an Injection vulnerability
GitHub

showdoc/showdoc

< 3.8.1

2026-05-05 20:21:53
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
GitHub

openmage/magento-lts

<= 20.17.0

2026-05-05 20:11:22
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)
GitHub

admidio/admidio

<= 5.0.8

2026-05-05 20:03:47
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
GitHub

openmage/magento-lts

<= 20.17.0

2026-05-05 19:35:57
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:15:57
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:13:04
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:11:34
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:08:46
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:07:10
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
GitHub

wwbn/avideo

<= 29.0

2026-05-05 18:58:14
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
GitHub

webonyx/graphql-php

<= 15.32.2

2026-05-05 17:24:58
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
GitHub

webonyx/graphql-php

< 15.32.2

2026-05-04 22:22:11
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
GitHub

mckenziearts/livewire-markdown-editor

< 1.3

2026-05-04 22:11:07
phpVMS has an /importer authorization bypass causing full database wipe
GitHub

nabeel/phpvms

< 7.0.6

2026-05-04 21:20:40
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:19:55
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:19:25
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:18:25
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:17:46
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:16:55
CI4MS has a Deactivated User Session Bypass (active=0)
GitHub

ci4-cms-erp/ci4ms

>= 0.26.0, <= 0.31.7.0

2026-05-04 20:50:57
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
GitHub

ci4-cms-erp/ci4ms

>= 0.31.1.0, <= 0.31.7.0

2026-05-04 20:50:12
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:59:31
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:58:44
Kirby CMS's read access to site, user and role information is not gated by permissions
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:50:25
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-04-30 21:03:23
ps_checkout allows unauthorized method invocation through unvalidated parameter
GitHub

prestashop/ps_checkout

< 5.3.0

2026-04-30 20:59:29
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:58:58
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:57:31
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:56:13
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:54:32
Admidio Missing Minimum Administrator Check in Role Membership Removal
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:53:20
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:51:13
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:49:25
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:47:29
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:46:23
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:44:26
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:42:23
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:37:25
ipl/web is vulnerable to reflected XSS by malformed search requests
GitHub

ipl/web

<= 0.13.0

2026-04-29 21:01:56
OpenID Connect nonce generated but never validated — ID token replay attack
GitHub

roadiz/openid

>= 2.7.0, < 2.7.18 · >= 2.6.0, < 2.6.31 · >= 2.5.0, < 2.5.45 · < 2.3.43

2026-04-29 20:51:43
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
GitHub

ci4-cms-erp/ci4ms

>= 0.26.0.0, <= 0.31.6.0

2026-04-29 20:42:45
« Previous Next »

Showing 201 to 250 of 5833 results

1 2 3 4 5 6 7 8 9 10 ... 116 117