Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:27
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:18
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
GitHub

froxlor/froxlor

< 2.3.6

2026-04-16 00:47:07
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
GitHub

froxlor/froxlor

<= 2.3.5

2026-04-16 00:46:47
Composer has a command injection via malicious perforce repository
GitHub

composer/composer

>= 2.0.0, < 2.2.27 · >= 1.0.0, < 2.2.27 · >= 2.3.0, < 2.9.6

2026-04-15 21:08:14
Composer has a command injection via malicious perforce reference
GitHub

composer/composer

>= 2.0.0, < 2.2.27 · >= 1.0.0, < 2.2.27 · >= 2.3.0, < 2.9.6

2026-04-15 21:08:04
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
GitHub

kimai/kimai

<= 2.52.0

2026-04-15 19:46:46
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
GitHub

kimai/kimai

< 2.53.0

2026-04-15 19:46:36
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
GitHub

pocketmine/pocketmine-mp

< 5.42.1

2026-04-15 19:43:34
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.14 · >= 4.0.0-RC1, <= 4.17.8

2026-04-14 23:36:11
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.14 · >= 4.0.0-RC1, <= 4.17.8

2026-04-14 23:35:16
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
GitHub

craftcms/cms

>= 5.6.0, < 5.9.15

2026-04-14 23:34:53
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:27:20
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:25:30
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:23:15
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:24
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:04
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:21:34
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:30
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:19
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:15:44
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:22
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:09
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:54
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:40
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:31
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:50:07
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:48
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:27
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:06
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
GitHub

s9y/serendipity

< 2.6.0

2026-04-14 22:32:40
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
GitHub

s9y/serendipity

< 2.6.0

2026-04-14 22:32:30
October Rain has Stored XSS via SVG Filter Bypass
GitHub

october/rain

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 22:29:51
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
GitHub

october/rain

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 22:29:43
October CMS has Stored XSS in Event Log Mail Preview
GitHub

october/system

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 20:02:51
October CMS has Stored XSS in Backend Editor Markup Classes
GitHub

october/system

>= 4.0.0, <= 4.1.9 · <= 3.7.13

2026-04-14 20:02:33
October Rain has a Twig Sandbox Bypass via Collection Methods
GitHub

october/rain

>= 4.0.0, <= 4.1.4 · <= 3.7.12

2026-04-14 20:02:06
Kimai leaks API Token Hash via Invoice Twig Template
GitHub

kimai/kimai

<= 2.52.0

2026-04-14 01:06:27
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler
GitHub

kimai/kimai

<= 2.52.0

2026-04-14 01:06:07
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
GitHub

webonyx/graphql-php

<= 15.31.4

2026-04-14 01:05:07
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.2 · >= 5.0.0, <= 5.5.4

2026-04-14 01:01:21
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.2 · >= 5.0.0, <= 5.5.4

2026-04-14 00:07:35
Craft Commerce hasVariant/hasProduct Blind SQL Injection
GitHub

craftcms/commerce

>= 5.0.0, < 5.6.0

2026-04-14 00:06:57
Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
GitHub

laravel/passport

>= 13.0.0, < 13.7.1 · < 13.7.1

2026-04-13 17:48:47
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:41:30
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:40:21
Potential XSS vulnerability in jQuery
GitHub

maximebf/debugbar

>= 1.12.0, < 3.5.0 · >= 1.2.0, < 3.5.0 · <= 4.0.0 · < 1.19.0

2026-04-13 13:46:46
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
GitHub

rhukster/dom-sanitizer

< 1.0.10

2026-04-10 21:08:31
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
GitHub

redaxo/source

< 5.21.0

2026-04-10 19:40:45
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
GitHub

redaxo/source

< 5.21.0

2026-04-10 19:40:25
« Previous Next »

Showing 301 to 350 of 5833 results

1 2 3 4 5 6 7 8 9 10 ... 116 117